2

I have a form in my Joomla! site. Once completed, the form should send an e-mail but only if some conditions have been met.

Not having been able to use standard, commercially available mailers while also checking those conditions, I am using jQuery.ajax to POST the content of the form to a custom PHP page that uses Factory::getMailer to actually send the e-mail.

Maybe it's convoluted, but it works.

This PHP page is called, sends a mail and then does nothing else. It is not a part of my page. Right now, it does not even know that it is part of my site.

Despite hiding this PHP file from spiders, the name and path of the php file is available by looking at the code on my page. The query string is also available by looking at the ajax function. Anybody could build their own page that calls my PHP page and use it to send mail around (why would they, I have no idea, but it worries me that they can.)

I already know how to stop this: defined('_JEXEC') or die('Restricted access');

Of course, it's pointless to just declare define('_JEXEC',1); on the line above. The _JEXEC definition should come from within Joomla!... but I don't know how to.

I have tried turning my PHP page into a module, thinking that embedding my PHP page in the structure of the CMS would have been enough. I know I successfully uploaded the module because the PHP page gets called, but I see the "Restricted access" response: _JEXEC is not defined.

What am I doing wrong and what should I do to define _JEXEC and pass it to my PHP file, rather than defining it directly in the PHP file?

I'm using Joomla! 3.9.19

Improve this question
3
  • 1
    If I rightly remember, using define('_JEXEC',1); will not work. Joomla has a dedicated com_ajax component in core that allows you to perform ajax request from module and plugins. You can find more information on it here: docs.joomla.org/Using_Joomla_Ajax_Interface
    – Lodder
    Jun 30, 2020 at 14:28
  • 1
    Is this not in a password protected section of your site? Are you wanting to involve a token? If this is a public page, then there isn't much that you can do to prevent people sending the email beyond some server-side validation in your ajax receiving script (prior to firing the email). Can you please clarify your scenario? A little more context may help.
    – mickmackusa
    Jun 30, 2020 at 21:56
  • Thinking about it, my main concern is that the inputs coming from the ajax script have been properly filtered (unless someone tampers with the JS on the page, I guess - but the harder this is to do, the less it's worth doing, right?) while sending unfiltered values to the PHP could execute some script (I got alarmed when the PHP vanished). Other than that, despite not being password-protected, the page has a questionnaire that makes it tedious to compile the form (and hard for machines, I hope) and a honeypot, so I'm more worried about calling the PHP file directly.
    – Firefighter
    Jul 1, 2020 at 7:40

1 Answer 1

Reset to default
1

There is no way to pass the JEXEC constant to the file, other than including a file that defines it - Generally you would want to go through Joomla for this.

Turn the whole form to a module and use com_ajax to make the AJAX calls to the helper of your module.

https://docs.joomla.org/Using_Joomla_Ajax_Interface

Alternatively, you could have used a mature form builder extension that has already dealt with all these.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.