phpwcms Support Forum

Code: Select all

Your IP ***.***.***.*** is not allowed to send  form !

Code: Select all

function getFormTrackingValue() {
	//creates a new form tracking entry in database
	//returns a <input type="hidden">
	$ip   		= getRemoteIP();
	$hash 		= md5($ip.$GLOBALS['phpwcms']["db_pass"].date('G'));
	$entry_id 	= time();	
	if(!empty($GLOBALS['phpwcms']["form_tracking"])) {
		$sql  = "INSERT INTO ".DB_PREPEND."phpwcms_formtracking SET ";
		$sql .= "formtracking_hash = '".$hash."', ";
		$sql .= "formtracking_ip = '".aporeplace($ip)."'";
		if($entry_created = mysql_query($sql, $GLOBALS['db'])) {
			$entry_id = mysql_insert_id($GLOBALS['db']);
		}
	}
	return '<input type="hidden" name="'.$hash.'" value="'.$entry_id.'" />';
}

function checkFormTrackingValue() {
	//compare given tracking value against db tracking entry
	$ip    = getRemoteIP();
	$hash1  = md5($ip.$GLOBALS['phpwcms']["db_pass"].date('G'));
	$hash2  = md5($ip.$GLOBALS['phpwcms']["db_pass"].date('G', time()-3600)); //max form delay of 1 hour
	$valid = false;
	if(isset($_POST[$hash1])) {
		// form method POST
		$entry_id = intval($_POST[$hash1]);
		$valid = true;
		unset($_POST[$hash1]);
	} elseif(isset($_POST[$hash2])) {
		// form method POST 1 hour ago
		$entry_id = intval($_POST[$hash2]);
		$valid = true;
		unset($_POST[$hash2]);
	} else {
		// hm, no hash means - ERROR
		$valid = false;
	}
	return $valid;
}