cama_contact_form 0.1.13 → 0.1.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0773dea2d0ad03b4c0179fc634372ab5fe9a6111da16fe0c187118475df052f6
-  data.tar.gz: 7868caf0afb73a4f508855521a1c4a15660a7786dbea9876303096402f198844
+  metadata.gz: b1df5cd27281765a9aa2642b6442a5613db070ac0777c32e0726e8efb8f05d48
+  data.tar.gz: '09312e91b0deb83c6c3508e8d84228deafbc8ef8ea8f45581a66e0ef36ea8cd6'
 SHA512:
-  metadata.gz: 9435100f0afd723a911aa6efee2fc5ed30610b7eea1a5f640eeb45d6e5ff92a7199d4360d599b0ebffcfc279e79fb17dff80135fb4db69e9d88233d356001ea8
-  data.tar.gz: 563ba96b2539b554971caee757e47ed840ac48918c7564993197095876d3435b74ac86974023caead09ebcb6742f979f86d1ab58e651d87f7b47e134a5036c66
+  metadata.gz: 2d129553fbafaa0ed0e647c27985ae4ccf426ca3cded590f895b965cc20d69dc488b2edf1a4a372411cb23896bfc1a9ef6ae5ae707935ab28a39fc57e08052c0
+  data.tar.gz: 5c35ee94f4eec03c48e273326aa57884fa185c2a933886bde25bbbbeda97de4b4d12338a388afdb10b37049d9f2ae91c02ae343044be83cd714b97ad1343f7d4

data/app/controllers/concerns/plugins/cama_contact_form/contact_form_controller_concern.rb

@@ -14,8 +14,13 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
   # Field types whose submitted value is a list of chosen option labels, joined for the mail summary.
   MULTI_VALUE_FIELD_TYPES = %w[radio checkboxes].freeze
 
-  # Elements that do something rather than say something, wherever they appear.
-  ACTIVE_ELEMENTS = %w[script style iframe object embed applet frame frameset form input button
+  # Elements that do something rather than say something, wherever they appear. `img` sits with the
+  # other external-resource loaders (`iframe`, `object`, `embed`): the notification e-mail renders a
+  # visitor's value with `raw`, so `<img src="http://attacker/">` there is a tracking beacon that
+  # fetches an attacker URL -- leaking that the owner opened the mail, and their IP -- the moment
+  # they open it, which no contact message legitimately needs. Ordinary prose with angle brackets
+  # (`Fish & Chips <today>`) is an unknown tag, not one of these, so it still passes.
+  ACTIVE_ELEMENTS = %w[script style iframe object embed img applet frame frameset form input button
                        link meta base svg math template].freeze
   ACTIVE_ELEMENT = %r{<\s*/?\s*(?:#{ACTIVE_ELEMENTS.join('|')})\b}i
   EVENT_HANDLER_IN_TAG = /<[a-zA-Z][^>]*\son[a-zA-Z]+\s*=/im
@@ -23,6 +28,19 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
     /<[a-zA-Z][^>]*\b(?:href|src|action|formaction|data|poster|srcdoc|background)\s*=\s*
        ["']?\s*(?:javascript|vbscript|data)\s*:/imx
 
+  # How many submissions one client IP may make to one form before the excess is refused, and the
+  # window that count rolls off over. The threshold is the site-wide `contact_form_max_submits` option
+  # (it tunes every form on the site at once, not one form); the window is camaleon_cms's own login
+  # throttle window, shared as one constant so the two cannot drift.
+  SUBMISSION_THROTTLE_WINDOW = CamaleonCms::CaptchaHelper::CAMA_ATTACK_WINDOW
+  SUBMISSION_THROTTLE_DEFAULT_MAX = 10
+
+  # How many files one submission may attach across all of its file fields, before the whole
+  # submission is refused. Core bounds each file's size (`filesystem_max_size`); this bounds the
+  # count, so the two together bound what one anonymous POST can write to disk and stuff into the
+  # notification mail. The site-wide `contact_form_max_files` option overrides it.
+  ATTACHMENT_COUNT_DEFAULT_MAX = 5
+
   def perform_save_form(form, fields, success, errors)
     attachments = []
     return unless validate_to_save_form(form, fields, errors)
@@ -47,9 +65,14 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
       fields[f[:cid].to_sym] = file_paths
     end
     new_settings = { 'fields' => fields, 'created_at' => Time.now.utc.strftime('%Y-%m-%d %H:%M:%S').to_s }.to_json
-    form_new = current_site.contact_forms.new(name: "response-#{Time.now.utc}", description: form.description,
+    # The random suffix keeps concurrent responses distinct: stamped only to the second, two visitors
+    # submitting within the same second parameterized to the same slug, and the site-scoped
+    # slug-uniqueness validation refused the second response with the generic error.
+    form_new = current_site.contact_forms.new(name: "response-#{Time.now.utc}-#{SecureRandom.hex(4)}",
+                                              description: form.description,
                                               settings: new_settings, site_id: form.site_id, parent_id: form.id)
     if form_new.save
+      record_submission(form)
       fields_data = convert_form_values(form, fields)
       message_body = form.mail_settings[:body].to_s.translate.cama_replace_codes(fields)
       content = render_to_string(partial: plugin_view('contact_form/email_content'), layout: false, formats: [:html],
@@ -74,10 +97,10 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
     end
   end
 
-  # CF-1: the auto-reply ("confirmation e-mail") recipient is whatever the visitor typed into the field
+  # The auto-reply ("confirmation e-mail") recipient is whatever the visitor typed into the field
   # named by `to_answer`, so it is fully attacker-controlled -- unchecked, the feature sends mail from
   # the site's own From address to anyone. The reply goes to the normalized address, or nowhere.
-  # Volume across submissions is a separate concern (CF-2, rate limiting).
+  # Volume across submissions is a separate concern (rate limiting, below).
   #
   # A refused present value is logged -- otherwise the response is indistinguishable from full
   # success and a lost confirmation is undiagnosable. The line names the form, not the value: the
@@ -89,7 +112,7 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
     value = fields[form.mail_settings[:to_answer].to_s.gsub(/(\[|\])/, '').to_sym]
     address = normalized_email_address(value)
     if address.nil? && value.present?
-      Rails.logger.warn("cama_contact_form: auto-reply for form #{form.id} skipped, recipient failed validation (CF-1)")
+      Rails.logger.warn("cama_contact_form: auto-reply for form #{form.id} skipped, recipient failed validation")
     end
     address
   end
@@ -108,6 +131,73 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
     address if address.match?(URI::MailTo::EMAIL_REGEXP)
   end
 
+  # Whether this client IP has already used up its budget for this form in the current window, so
+  # `save_form` can refuse the excess before any mail, upload or row is written -- the endpoint is
+  # public and, unless the form carries a captcha field, otherwise unthrottled. A read only: only a
+  # *stored* submission spends budget (see `record_submission`), so a flood of submissions that fail
+  # validation -- or that never solve a captcha -- cannot exhaust the window and lock out a co-NAT
+  # visitor whose own submission is valid.
+  def submission_over_limit?(form)
+    Rails.cache.read(submission_throttle_key(form), raw: true).to_i >= submission_limit
+  end
+
+  # Spend one unit of this IP's per-form budget, called once a row has actually been written so the
+  # cap tracks resource-consuming submissions rather than mere attempts.
+  #
+  # The counter is an ATOMIC Rails.cache increment mirroring camaleon_cms's login throttle. Its helper
+  # (cama_captcha_increment_attack) is deliberately not reused: it also mutates session state, which
+  # this IP-only throttle must not do on a public, session-light request (and its unit spec drives a
+  # bare controller with no session). `raw: true` keeps the value a bare integer so Redis/Memcached
+  # INCR is atomic (a harmless no-op on Memory/File stores). Older Memory/File stores (Rails < 7.1)
+  # return nil for a missing key instead of seeding it; seed it then, with `unless_exist` so the seed
+  # can never overwrite a counter a concurrent request has already advanced.
+  #
+  # The window is FIXED, not sliding: the TTL is anchored when the key is first written and not
+  # refreshed on later increments (ActiveSupport preserves the original `expires_at`, and
+  # Redis/Memcached only set a TTL at creation), so the budget resets in full once the window since
+  # the first stored submission elapses. The throttle is only as strong as the host's cache: it fails
+  # open on a null store, and on a per-process store (Rails' default MemoryStore, or FileStore across
+  # hosts) each worker counts on its own, so an effective cap needs a shared store (Redis/Memcached).
+  # The key is the client IP as camaleon_cms resolves it (`request.remote_ip`), so it is only as
+  # trustworthy as the app's trusted-proxy configuration.
+  def record_submission(form)
+    key = submission_throttle_key(form)
+    counted = Rails.cache.increment(key, 1, expires_in: SUBMISSION_THROTTLE_WINDOW, raw: true)
+    return unless counted.nil?
+
+    Rails.cache.write(key, 1, expires_in: SUBMISSION_THROTTLE_WINDOW, unless_exist: true, raw: true)
+  end
+
+  def submission_throttle_key(form)
+    "cama_contact_form_submit:#{current_site.id}:#{request.remote_ip}:#{form.id}"
+  end
+
+  # The per-window budget from `contact_form_max_submits`, as a positive integer.
+  def submission_limit
+    positive_site_option('contact_form_max_submits', SUBMISSION_THROTTLE_DEFAULT_MAX)
+  end
+
+  # The per-submission attachment budget from `contact_form_max_files`, as a positive integer.
+  def attachment_limit
+    positive_site_option('contact_form_max_files', ATTACHMENT_COUNT_DEFAULT_MAX)
+  end
+
+  # A limit option, as a positive integer. get_option hands back whatever was stored, and
+  # camaleon_cms's set_option runs values through String#to_var -- so a "true"/"false" option is a
+  # boolean (and `false.to_i` raises), a cleared one is nil, and a stray "unlimited"/0 would coerce
+  # to 0 and refuse every submission (or every attachment) site-wide. Anything that is not a
+  # positive integer falls back to the default rather than 500-ing or silently bricking the form; to
+  # loosen a limit an operator sets a higher positive integer.
+  #
+  # A String is parsed in base 10 explicitly: to_var stores only canonical numerals as numbers, so
+  # a typed "010" survives as a String, and bare Integer() would read its leading zero as octal --
+  # a silently wrong limit. Base 10 reads it as ten, and rejects "0x10" into the fallback.
+  def positive_site_option(name, default)
+    value = current_site.get_option(name, default)
+    parsed = value.is_a?(String) ? Integer(value, 10, exception: false) : Integer(value, exception: false)
+    parsed&.positive? ? parsed : default
+  end
+
   # A visitor's submission is rejected, not escaped, for the same reason an untrusted author's is:
   # what is stored and redisplayed then equals what was submitted, so rendering it verbatim adds
   # nothing.
@@ -185,16 +275,19 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
 
   # form validations
   def validate_to_save_form(form, fields, errors)
-    # Refuse outright and stop, before any other validation runs.
-    #
-    # Nothing is stored either way, so there is nothing to gain by continuing -- and continuing means
-    # running the rest of this method over input already known to be hostile, including a reCAPTCHA
-    # round-trip to an external service.
+    # One refusal, outright and first, for every shape no real form produces -- a missing form, a
+    # non-hash fields, a forged file-field value. Each is a forged request, not a validation error
+    # the visitor can act on; nothing is stored either way, so there is nothing to gain by
+    # continuing -- and continuing means running the rest of this method over input already known
+    # to be hostile, including a reCAPTCHA round-trip to an external service. Rejecting the file
+    # shapes is also what keeps forged entries away from the uploader (see
+    # malformed_file_submission?, whose walk the earlier disjuncts' short-circuit vouches for).
     #
     # The message names no field and quotes nothing back. The frontend flash partial renders with
     # `raw`, so echoing the refused value there would make the refusal itself an injection sink --
     # the same trap as the admin path.
-    if form.blank? || !(fields.is_a?(Hash) || fields.is_a?(ActionController::Parameters))
+    if form.blank? || !(fields.is_a?(Hash) || fields.is_a?(ActionController::Parameters)) ||
+       malformed_file_submission?(form, fields)
       errors << t('.invalid_request_val', default: 'That form could not be submitted. Please try again.')
       return false
     end
@@ -209,6 +302,25 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
 
     validate = true
 
+    # perform_save_form's file loop uploads and persists every entry submitted under a file field,
+    # so the entry count is budget the visitor spends -- bounded here, before any upload runs,
+    # rather than left to multiply against the per-file size cap. Over the cap the submission is
+    # refused whole, with the other validation errors: trimming to the first N would silently drop
+    # files the visitor believes they sent, and the file input is `multiple` with no client-side
+    # cap, so a legitimate visitor can hit this and needs the actionable message.
+    if attachment_count(form, fields) > (max_files = attachment_limit)
+      # The %{max} substitution runs on the resolved message so an author-customized
+      # `invalid_files_count` can carry the limit too -- `the_message` returns a custom message
+      # verbatim, while the i18n default has already interpolated and is left untouched.
+      errors << form.the_message('invalid_files_count',
+                                 t('.too_many_files_val',
+                                   max: max_files,
+                                   default: 'Too many files attached (maximum %{max}). ' \
+                                            'Please remove some files and try again.'))
+                    .to_s.gsub('%{max}', max_files.to_s)
+      validate = false
+    end
+
     form.fields.each do |f|
       cid = f[:cid].to_sym
       label = f[:label].to_sym
@@ -250,6 +362,39 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
     validate
   end
 
+  # Whether any file field carries a value no real form submission produces. The renderer encodes a
+  # file field as `fields[cid][]` file parts, and Rack drops an empty-filename part, so the only
+  # legitimate shapes are an absent value -- nil, literally, which is why the skip below tests
+  # exactly that and not `blank?`: a blank-but-present value (`fields[cid]=`, a JSON `false`) is as
+  # forged as any other scalar, and the upload loop's `.to_a` raises on it all the same -- and an
+  # array of uploaded files. A bare string, a nested hash, a non-file entry -- each previously
+  # raised in the upload loop (`String#to_a`, `original_filename`), an unauthenticated 500.
+  #
+  # Refusing the whole submission, rather than skipping the forged entries, is load-bearing: a
+  # String that survived to cama_tmp_upload would be treated there as a URL to download or a local
+  # path to copy, and an anonymous visitor must never steer that.
+  def malformed_file_submission?(form, fields)
+    form.fields.any? do |f|
+      next false unless f[:field_type] == 'file'
+
+      value = fields[f[:cid].to_sym]
+      next false if value.nil?
+
+      !value.is_a?(Array) || !value.all?(ActionDispatch::Http::UploadedFile)
+    end
+  end
+
+  # The number of entries perform_save_form's upload loop would iterate for this submission:
+  # everything submitted under a file field. The shape gate has already refused anything that is
+  # not an absent value or an array of uploaded files, so this is those arrays' sizes summed --
+  # `Array()` keeps the sum total without a shape judgment of its own, the same counting
+  # convert_form_values uses.
+  def attachment_count(form, fields)
+    form.fields.sum do |f|
+      f[:field_type] == 'file' ? Array(fields[f[:cid].to_sym]).size : 0
+    end
+  end
+
   # form values with labels + values to save
   def convert_form_values(form, fields)
     values = {}

data/app/controllers/plugins/cama_contact_form/admin_forms_controller.rb

@@ -6,23 +6,10 @@ class Plugins::CamaContactForm::AdminFormsController < CamaleonCms::Apps::Plugin
   include Plugins::CamaContactForm::MainHelper
   include Plugins::CamaContactForm::ContactFormControllerConcern
 
-  # The markup gate delegates to CamaleonCms::UnsafeMarkup, which ships in camaleon_cms >= 2.9.3. That
-  # floor is not expressible as a gemspec dependency -- camaleon_cms depends on this gem, so a reverse
-  # pin would be circular -- and camaleon_cms 2.9.2 pins `cama_contact_form ~> 0.1.0`, wide enough to
-  # resolve this release against a core that lacks the detector. Fail fast and clearly at load, rather
-  # than with a bare NameError deep inside the first untrusted save: without the detector nothing can
-  # be gated, so the plugin must not run at all against an incompatible core.
-  def self.core_markup_detector_available?
-    defined?(CamaleonCms::UnsafeMarkup) ? true : false
-  end
-
-  def self.ensure_core_markup_detector!
-    return if core_markup_detector_available?
-
-    raise "cama_contact_form #{::CamaContactForm::VERSION} requires camaleon_cms >= 2.9.3 " \
-          '(CamaleonCms::UnsafeMarkup is unavailable).'
-  end
-  ensure_core_markup_detector!
+  # The markup gate below delegates to CamaleonCms::UnsafeMarkup (camaleon_cms >= 2.9.4); the version
+  # floor that guarantees it -- and the front_cache fix the submission throttle needs -- is enforced at
+  # boot by CamaContactForm::CoreCompatibility, from the engine initializer, so it holds for every
+  # controller in every load mode rather than only where this class body happens to load.
 
   before_action :set_form, only: %w[show edit update destroy]
   add_breadcrumb I18n.t('plugins.cama_contact_form.title', default: 'Contact Form'),
@@ -196,7 +183,7 @@ class Plugins::CamaContactForm::AdminFormsController < CamaleonCms::Apps::Plugin
 
   # A well-formed translation marker (`<!--:-->`, `<!--:en-->`). `rendered_forms` strips these to
   # produce the marker-free string the renderer emits, so the gate judges that form too. Reused from
-  # the core detector rather than re-spelled: the markers this strips and the ones
+  # CamaleonCms::UnsafeMarkup's own constant rather than re-spelled: the markers this strips and the ones
   # CamaleonCms::UnsafeMarkup scans around must share one grammar for the gate to stay sound, so they
   # share one constant.
   TRANSLATION_MARKER = CamaleonCms::UnsafeMarkup::TRANSLATION_MARKER
@@ -225,13 +212,15 @@ class Plugins::CamaContactForm::AdminFormsController < CamaleonCms::Apps::Plugin
   MAX_OPTIONS_PER_FIELD = 100
   MAX_GATED_VALUE_BYTES = 64 * 1024
 
-  # The messages the form editor offers, plus `invalid_content`, which the gate itself emits.
+  # The messages the form editor offers, plus the ones the save-time gates themselves emit
+  # (`invalid_content`, `invalid_files_count`) -- a key missing here is not merely un-offered, it is
+  # stripped from every editor save, so a message set any other way would be silently erased.
   #
   # Permitted rather than taken wholesale. `railscf_message` used to go straight from params into the
   # gate, which runs a full Loofah parse per leaf -- so the number of parses was chosen by the caller.
   # Permitting also stops unbounded junk being persisted into `settings.to_json`.
   MESSAGE_KEYS = %w[mail_sent_ok mail_sent_ng validation_error invalid_required invalid_email
-                    captcha_not_match invalid_content].freeze
+                    captcha_not_match invalid_content invalid_files_count].freeze
 
   private
 
@@ -486,8 +475,18 @@ class Plugins::CamaContactForm::AdminFormsController < CamaleonCms::Apps::Plugin
   # Returns the name of the first malformed structural value, or nil. Same rule: the key only, never
   # the value the author submitted.
   def first_malformed_structural_key(fields)
+    seen_cids = {}
     fields.each do |field|
-      return 'cid' unless at(field, :cid).to_s.match?(CID_FORMAT)
+      cid = at(field, :cid).to_s
+      return 'cid' unless cid.match?(CID_FORMAT)
+      # A duplicate is as forged as a bad format: the editor generates cids (`c1, c2, ...`) and
+      # keys the params by them, so two fields sharing one can only arrive by hand. Stored, they
+      # collide everywhere downstream -- the renderer emits colliding input names, and every
+      # per-field consumer reads one field's submitted value as the other's (the attachment
+      # counter would count it twice; the upload loop 500s on its own second pass).
+      return 'cid' if seen_cids.key?(cid)
+
+      seen_cids[cid] = true
 
       type = at(field, :field_type).to_s
       return 'field type' unless FIELD_TYPES.include?(type)
@@ -547,7 +546,7 @@ class Plugins::CamaContactForm::AdminFormsController < CamaleonCms::Apps::Plugin
     [string]
   end
 
-  # Each rendered form is judged by CamaleonCms::UnsafeMarkup, the core scan-and-reject detector this
+  # Each rendered form is judged by CamaleonCms::UnsafeMarkup, camaleon_cms's scan-and-reject detector this
   # gate is kept in parity with. It parses once and refuses the value when the safe-list scrubber
   # would remove anything, when a kept attribute smuggles markup (`title="&lt;img ...&gt;"` reaching a
   # `data-html` sink), when dangerous inline CSS survives, or when the value carries one of the

data/app/controllers/plugins/cama_contact_form/front_controller.rb

@@ -8,7 +8,11 @@ class Plugins::CamaContactForm::FrontController < CamaleonCms::Apps::PluginsFron
   # here add your custom functions
   def save_form
     flash[:contact_form] = {}
-    @form = current_site.contact_forms.find_by(id: params[:id])
+    # `parent_id: nil` restricts the lookup to authored forms. `contact_forms` also holds every stored
+    # response (a child row, `parent_id` set), and a response's `fields` is empty, so it sails through
+    # validation -- submitting a response's id would write a fresh child row and open it its own throttle
+    # budget, so the flood cap could be lapped by walking the (sequential, guessable) response ids.
+    @form = current_site.contact_forms.find_by(id: params[:id], parent_id: nil)
     fields = params[:fields]
     errors = []
     success = []
@@ -16,9 +20,22 @@ class Plugins::CamaContactForm::FrontController < CamaleonCms::Apps::PluginsFron
     args = { form: @form, values: fields, flag: true }
     hooks_run('contact_form_before_submit', args)
     if args[:flag]
-      perform_save_form(@form, fields, success, errors)
+      # Refuse a flood before it can mail, upload or write a row. Keyed on @form, so a bogus id
+      # (which perform_save_form rejects anyway, cheaply) is left to it rather than throttled against
+      # no form.
+      if @form.present? && submission_over_limit?(@form)
+        errors << t('.too_many_requests',
+                    default: 'Too many submissions from your network. Please wait a few minutes and try again.')
+      else
+        perform_save_form(@form, fields, success, errors)
+      end
       if success.present?
         flash[:contact_form][:notice] = success.join('<br>')
+        # Success and errors coexist on exactly one path: the submission stored and mailed, but a
+        # file failed its upload (over core's size cap, or refused by the content scan). Showing
+        # only the notice told the visitor everything arrived when a file they sent was dropped --
+        # the errors ride along so the success never silently trims the submission.
+        flash[:contact_form][:error] = errors.join('<br>') if errors.present?
       else
         flash[:contact_form][:error] = errors.join('<br>')
         # Redisplaying the submission is the only reason it ever reaches the page, so a submission
@@ -34,8 +51,16 @@ class Plugins::CamaContactForm::FrontController < CamaleonCms::Apps::PluginsFron
         # `@form` is whatever `find_by_id` returned, which is nil for a deleted or bogus id -- a
         # POST anyone can make without credentials. `unsafe_submitted?` fails closed on that, so the
         # guard below is belt and braces for the `@form.id` read on the line after it.
+        # Uploads are dropped from the stash whether they arrive bare or -- the only shape the
+        # renderer produces -- as an array. They buy nothing (a file input always redisplays with
+        # value=""), and they cost the session: each file serializes as junk bytes into the cookie
+        # store, so a refused submission with enough attachments overflowed the 4KB cookie into a
+        # 500 -- on the over-cap refusal, for exactly the visitors the refusal message is for.
         if @form.present? && fields.respond_to?(:delete_if) && !unsafe_submitted?(@form, fields)
-          flash[:values] = fields.delete_if { |_k, v| v.instance_of?(::ActionDispatch::Http::UploadedFile) }
+          flash[:values] = fields.delete_if do |_k, v|
+            v.instance_of?(::ActionDispatch::Http::UploadedFile) ||
+              (v.is_a?(Array) && v.any?(::ActionDispatch::Http::UploadedFile))
+          end
           flash[:values_form_id] = @form.id
         end
       end

data/app/models/plugins/cama_contact_form/cama_contact_form.rb

@@ -10,10 +10,10 @@ class Plugins::CamaContactForm::CamaContactForm < ActiveRecord::Base
 
   # A self-referential parent/child: a form and its stored response rows. There is no reciprocal
   # `belongs_to :parent` to point `inverse_of` at, so the cop is disabled for this association only.
-  # rubocop:disable Rails/InverseOf
+  # rubocop:disable-next Rails/InverseOf
   has_many :responses, class_name: 'Plugins::CamaContactForm::CamaContactForm', foreign_key: :parent_id,
                        dependent: :destroy
-  # rubocop:enable Rails/InverseOf
+
   validates :name, presence: true
   validates :slug, uniqueness: { scope: :site_id }
 
@@ -95,18 +95,28 @@ class Plugins::CamaContactForm::CamaContactForm < ActiveRecord::Base
     self.settings = {}.to_json if settings.blank?
   end
 
+  # Deletes the files this response uploaded, on destroy. Those files live directly in the site's
+  # `public/contact_form/<site_id>` directory, and this is confined to delete only from there: each
+  # stored path is reduced to its basename and rebuilt inside that root, so a path that is absolute,
+  # climbs out with `../`, or is otherwise hostile -- as an untrusted import can leave in a
+  # response's settings -- can at most name a file already sitting in the root, never one outside
+  # it. Missing parent, non-hash settings and non-string entries are tolerated rather than raising
+  # on a destroy any `:manage, :plugins` holder can trigger.
   def delete_uploaded_files
     return if parent_id.nil?
 
-    form = self.class.find_by id: parent_id
+    form = self.class.find_by(id: parent_id)
     response_data = the_settings[:fields]
-    file_cids = form.fields
-                    .select { |f| f[:field_type] == 'file' }
-                    .map { |f| f[:cid].to_sym }
-
-    file_cids
-      .flat_map { |cid| response_data[cid] }
-      .map { |file| file.sub Rails.application.routes.url_helpers.cama_root_url, Rails.public_path.to_s }
-      .each { |file| FileUtils.rm_f file }
+    return if form.nil? || !response_data.is_a?(Hash)
+
+    media_root = Rails.public_path.join('contact_form', site_id.to_s).to_s
+    form.fields
+        .select { |f| f[:field_type] == 'file' }
+        .flat_map { |f| response_data[f[:cid].to_sym] }
+        .compact
+        .each do |file|
+          target = File.expand_path(File.basename(file.to_s), media_root)
+          FileUtils.rm_f(target) if File.dirname(target) == media_root
+        end
   end
 end

data/config/locales/es.yml

@@ -107,4 +107,6 @@ es:
           success_form_val: 'Su mensaje a sido enviado satisfactoriamente. Muchas gracias!'
           error_form_val: 'A ocurrido un error, por favor intente de nuevo'
           invalid_content_val: 'Su mensaje contiene caracteres que no están permitidos. Por favor, elimine cualquier HTML o comillas dobles e inténtelo de nuevo.'
-          invalid_request_val: 'No se pudo enviar ese formulario. Por favor, inténtelo de nuevo.'
+          invalid_request_val: 'No se pudo enviar ese formulario. Por favor, inténtelo de nuevo.'
+          too_many_requests: 'Demasiados envíos desde tu red. Espera unos minutos e inténtalo de nuevo.'
+          too_many_files_val: 'Demasiados archivos adjuntos (máximo %{max}). Elimina algunos archivos e inténtalo de nuevo.'

data/config/locales/zh-CN.yml

@@ -106,3 +106,5 @@ zh-CN:
           error_form_val: '引发了一个错误，请重试！'
           invalid_content_val: '您的消息包含不允许使用的字符。请删除所有 HTML 或双引号后重试。'
           invalid_request_val: '无法提交该表单。请重试。'
+          too_many_requests: '来自您网络的提交次数过多。请稍等几分钟后重试。'
+          too_many_files_val: '附件文件过多（最多 %{max} 个）。请删除部分文件后重试。'

data/lib/cama_contact_form/core_compatibility.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'cama_contact_form/version'
+
+module CamaContactForm
+  # camaleon_cms version gate. The plugin needs a core new enough to (a) expose
+  # `CamaleonCms::UnsafeMarkup` (the admin markup gate delegates to it) and (b) not wipe `Rails.cache`
+  # on every frontend POST -- camaleon_cms before 2.9.4 did, through the bundled front_cache plugin,
+  # which left the submission throttle counter erased each submission and unable to ever trigger.
+  #
+  # The floor is not expressible as a gemspec dependency (camaleon_cms depends on this gem, so a
+  # reverse pin would be circular), and older camaleon_cms releases pin `cama_contact_form` wide
+  # enough to resolve this release. So the plugin verifies the version itself, at boot, from the
+  # engine initializer -- a seat every process passes through before serving, unlike a controller
+  # class body, which under lazy loading may never load before FrontController#save_form is served.
+  # It fails fast with an actionable error rather than a broken gate or a silently dead throttle at
+  # the first untrusted request.
+  module CoreCompatibility
+    MINIMUM_CORE_VERSION = '2.9.4'
+
+    module_function
+
+    def compatible_core?
+      defined?(CamaleonCms::VERSION) &&
+        Gem::Version.new(CamaleonCms::VERSION) >= Gem::Version.new(MINIMUM_CORE_VERSION)
+    end
+
+    def ensure_compatible_core!
+      return if compatible_core?
+
+      raise "cama_contact_form #{CamaContactForm::VERSION} requires camaleon_cms >= #{MINIMUM_CORE_VERSION}."
+    end
+  end
+end

data/lib/cama_contact_form/engine.rb

@@ -1,9 +1,19 @@
 # frozen_string_literal: true
 
+require 'cama_contact_form/core_compatibility'
+
 # Top-level namespace for the cama_contact_form gem.
 module CamaContactForm
   # Rails engine that registers the plugin (and its `forms` shortcode) with a Camaleon CMS host.
   class Engine < ::Rails::Engine
+    # Fail fast at boot on a camaleon_cms too old for the markup gate or the submission throttle to
+    # work (see CoreCompatibility). Seated here, not in a controller class body, so the check runs in
+    # every process -- including a lazy-loaded one that would otherwise serve save_form before the
+    # admin controller (which carries the other half of the requirement) ever loads.
+    initializer 'cama_contact_form.ensure_compatible_core' do
+      CamaContactForm::CoreCompatibility.ensure_compatible_core!
+    end
+
     # Declare this plugin's shortcode name to Camaleon's boot-time shortcode registry so the CMS
     # save-time `content_shortcodes` gate can detect and gate it. Detection needs the name at boot
     # because the per-request shortcode list is empty at an admin save; the render-time handler stays

data/lib/cama_contact_form/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CamaContactForm
-  VERSION = '0.1.13'
+  VERSION = '0.1.14'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cama_contact_form
 version: !ruby/object:Gem::Version
-  version: 0.1.13
+  version: 0.1.14
 platform: ruby
 authors:
 - Owen Peredo
@@ -67,6 +67,7 @@ files:
 - config/routes.rb
 - db/migrate/20160517143441_create_db_structure.rb
 - lib/cama_contact_form.rb
+- lib/cama_contact_form/core_compatibility.rb
 - lib/cama_contact_form/engine.rb
 - lib/cama_contact_form/version.rb
 - lib/tasks/cama_contact_form_tasks.rake
@@ -88,7 +89,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.17
+rubygems_version: 4.0.19
 specification_version: 4
 summary: Contact Form Plugin for Camaleon CMS
 test_files: []