session_start();
/*
Plugin Name: PXS Mail Form
Plugin URI: http://www.phrixus.co.uk/pxsmail/
Description: Creates a mail form with multi part verification, various messages and an auto redirect on successful send. Originally based on the contact form by Ryan Duff. Enter {mailform} where you want the form. Recent updates include referrer checks, exploit management and the ability to run with the Markdown plugin. New feature for this release allows the sender to CC themselves.
Author: Shane Marriott
Author URI: http://www.phrixus.co.uk
Version: 2.6
*/
/*This function embeds the Contact Form submenu under the Options tab.*/
function pxs_admin_menu() {
if (function_exists('add_options_page')) {
add_options_page('options-general.php', 'PXS-Mail', 8, basename(__FILE__), 'pxs_options_subpanel');
}
}
function ValidateEmail($e,$v=-1) {
global $verbose;
/*
Return codes:
0: appears to be a valid email
1: didn't match pattern of a valid email
*/
if ($v==-1) { $v=$verbose; }
if (!preg_match("/^[a-z0-9.+-_]+@([a-z0-9-]+(.[a-z0-9-]+)+)$/i", $e, $grab)) {
return 1;
}
return 0;
}
// Function written to create arrays for the recipient information if more than one is required
function pxs_multimail($info){
$testlist = explode(";", $info);
foreach ($testlist as $index=>$items) {
$testlist[$index] = explode (",", $items);
}
return $testlist;
}
/*Wrapper function which calls the form.*/
function pxs_callback( $content )
{
$div_error = '
';
$secure = 0;
$check = 0;
$pxs_mmt = get_option('pxs_email');
if (strpos($pxs_mmt, ";") > 0) {
$pxs_mm = 1;
$listing = pxs_multimail($pxs_mmt);
}
// This section sets the subject for the message based on options and information set in the form
if (get_option('pxs_user_subject') != 1){
$subject = get_option('pxs_subject');
$show_subject = 0;
} else {
$show_subject = 1;
$subject = '';
if (empty($_POST['your_subject'])) {
$subject = get_option('pxs_subject');
$subject = stripslashes($subject);
$subject_mm = '';
} else {
$subject = $_POST['your_subject'];
$subject = stripslashes($subject);
$subject_mm = ': '.$subject;
}
}
if(!(empty($_POST['email']))){
$pxs_mail = ValidateEmail($_POST['email'],$v=-1);
}
if(!(empty($_POST['your_name']) || empty($_POST['email']) || empty($_POST['msg']) || empty($_POST['pxscheck'])) && $pxs_mail == 0) {
$pxs_redirect = get_option('pxs_redirect_loc');
$pxs_redirect = stripslashes($pxs_redirect);
$pxs_time = get_option('pxs_redirect_time');
if ($pxs_redirect){
$success_redirect = '';
$hack_redirect = '';
}
if ($_POST['pxscheck'] !== $_SESSION["pxscheck"]) {
echo $hack_redirect;
exit();
}
if ($pxs_mm == 1) {
$pxs_mmr = $_POST['recipient'];
$recipient = $listing[$pxs_mmr]['0'];
if ($recipient == 'all') {
$bodyCount = count($listing)-2;
$bodyStart = 0;
$recipient = '';
do {
$recipient .= $listing[$bodyStart]['0'] . ',';
$bodyStart = $bodyStart + 1;
} while ($bodyCount >= $bodyStart);
}
$subject = $listing[$pxs_mmr]['2'].$subject_mm;
} else {
$recipient = get_option('pxs_email');
}
$success_msg = get_option('pxs_success_msg');
$success_msg = stripslashes($success_msg);
// Hack prevention code: Stop spammers exploiting the plugin. Will try to kill the script if it detects an attack but will also safely proceed if nothing is actually detected by stripping out what it ought to have found earlier!!.
if (preg_match("/(\r|\n)/", $_POST['your_name'])!==0) {
echo $hack_redirect;
exit();
}
$name = stripslashes($_POST['your_name']);
if (preg_match("/(\r|\n)/", $_POST['email'])!==0){
echo $hack_redirect;
exit();
}
$email = stripslashes($_POST['email']);
if (preg_match("/(\r|\n)/", $_POST['blog'])!==0){
echo $hack_redirect;
exit();
}
$blog = $_POST['blog'];
if (preg_match("/(\r|\n)/", $_POST['your_subject'])!==0) {
echo $hack_redirect;
exit();
}
$blog_chars = get_option('blog_charset');
$headers = '';
$headers = "From: $name <$email>\n"; // your email client will show the person's email address like normal
$headers .= "Content-Type: text/plain; charset=$blog_chars\n"; // sets the mime type
$fullmsg = "$name wrote:\n";
$fullmsg .= $_POST['msg'] . "\n\n";
$fullmsg .= "Website: " . $blog . "\n";
$fullmsg .= "IP: " . getip();
mail($recipient, $subject, stripslashes($fullmsg), $headers);
if ($_POST['ccme'] == 1){
mail($email, $subject, stripslashes($fullmsg), $headers);
}
$results = '