There seems to be a major issue on several v2.5.7 sites I've been asked to help with, where emails are not being validated when entered into the built-in com_contact component on a standard contact-us form.
The contact form will error out when the TLD used by the submitter ends with any value using more than 4 characters at the 'dot' end of the domain name... i.e., 5 characters of '.cloud' will not be accepted, while the 3 characters as '.com' work as expected. I've verified that this is a repeatable issue with every form submitted when using the new/extended domain names in an email address. The forms all work perfectly otherwise.
This site will not be upgraded to anything newer just yet, and the core code has been heavily patched to cover bugs and security issues otherwise - so - it will need another patch to accommodate a fix for this too. In other words, nothing but hand coding can be done.
From what I've uncovered so far, the validation code responsible for the email address itself is in: /libraries/joomla/form/rules/email.php
The code doing the validating seems to be the regex at line #27... and I loathe and don't understand enough about regex to be able to proffer a sure fix.
Can someone familiar give me a pointer on whether my assumption is correct - that this is the problem code... or where it might be located if this isn't the right file? And - if it is the right place, what changes can be made to allow for a much longer TLD to be acceptable in an email address.
Here's the entire function code in email.php:
class JFormRuleEmail extends JFormRule
{
/**
* The regular expression to use in testing a form field value.
*
* @var string
* @since 11.1
*/
protected $regex = '^[\w.-]+(\+[\w.-]+)*@\w+[\w.-]*?\.\w{2,4}$';
/**
* Method to test the email address and optionally check for uniqueness.
*
* @param JXMLElement &$element The JXMLElement object representing the <field /> tag for the form field object.
* @param mixed $value The form field value to validate.
* @param string $group The field name group control value. This acts as as an array container for the field.
* For example if the field has name="foo" and the group value is set to "bar" then the
* full field name would end up being "bar[foo]".
* @param JRegistry &$input An optional JRegistry object with the entire data set to validate against the entire form.
* @param object &$form The form object for which the field is being tested.
*
* @return boolean True if the value is valid, false otherwise.
*
* @since 11.1
* @throws JException on invalid rule.
*/
public function test(&$element, $value, $group = null, &$input = null, &$form = null)
{
// If the field is empty and not required, the field is valid.
$required = ((string) $element['required'] == 'true' || (string) $element['required'] == 'required');
if (!$required && empty($value))
{
return true;
}
// Test the value against the regular expression.
if (!parent::test($element, $value, $group, $input, $form))
{
return false;
}
// Check if we should test for uniqueness.
$unique = ((string) $element['unique'] == 'true' || (string) $element['unique'] == 'unique');
if ($unique)
{
// Get the database object and a new query object.
$db = JFactory::getDBO();
$query = $db->getQuery(true);
// Build the query.
$query->select('COUNT(*)');
$query->from('#__users');
$query->where('email = ' . $db->quote($value));
// Get the extra field check attribute.
$userId = ($form instanceof JForm) ? $form->getValue('id') : '';
$query->where($db->quoteName('id') . ' <> ' . (int) $userId);
// Set and query the database.
$db->setQuery($query);
$duplicate = (bool) $db->loadResult();
// Check for a database error.
if ($db->getErrorNum())
{
JError::raiseWarning(500, $db->getErrorMsg());
}
if ($duplicate)
{
return false;
}
}
return true;
}
}
email.php
is for server side validation. But it does no effect on browser side validation which makes the email field red and form cannot be submitted. Even if I put.*
inemail.php
that makes no difference. I found 2-3 other places where js is doing regexp validation of fields withvalidate-email
class but changing them didn't help. That's why I'm asking where the ..heck is this validation taking place.grep -r '@\('
I finally got rid of this validation trouble by fixingmedia/system/js/validate.js
andmedia/system/js/validate-uncompressed.js
.