You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The HelpsController allows non-logged in users to send a help email, and the required attribute on form elements ensures that the email is supplied.
However we've had a case where a bot discovered the form and submitted it, which generated a bunch of HelpsMailer Sidekiq jobs which failed, because the From address was not supplied (taken from the email input element).
Perhaps the controller should verify the input before sending off the email job?
The HelpsController allows non-logged in users to send a help email, and the
required
attribute on form elements ensures that theemail
is supplied.However we've had a case where a bot discovered the form and submitted it, which generated a bunch of HelpsMailer Sidekiq jobs which failed, because the
From
address was not supplied (taken from theemail
input element).Perhaps the controller should verify the input before sending off the email job?
Here's an example of a Honeybadger notification:
https://app.honeybadger.io/projects/77112/faults/108352644
And the non-Shibboleth request that generated it:
Other request activity from that IP address makes it clear that it was a bot probing for vulnerabilities.
The text was updated successfully, but these errors were encountered: