##############################################################################
# FormMail Version 1.9 #
# Copyright 1996-2001 Matt Wright mattw@worldwidemart.com #
# Created 06/09/95 Last Modified 08/03/01 #
# Matt's Script Archive, Inc.: http://www.worldwidemart.com/scripts/ #
##############################################################################
# If you run into any problems while trying to configure this scripts, help #
# is available. The steps you should take to get the fastest results, are: #
# 1) Read this file thoroughly. #
# 2) Consult the Matt's Script Archive Frequently Asked Questions: #
# http://www.worldwidemart.com/scripts/faq/ #
# 3) If you are still having difficulty installing this script, send #
# e-mail to: scripts-help@tahoenet.com #
# Include any error messages you are receiving and as much detail #
# as you can so we can spot your problem. Also include the variable#
# configuration block that is located at the top of the script. #
# #
# Hopefully we will be able to help you solve your problems. Thank you. #
##############################################################################
FormMail is a universal WWW form to E-mail gateway. There is only one
required form input tag which must be specified in order for this script to
work with your existing forms. Other hidden configuration fields can also
be used to enhance the operation of FormMail on your site. Version 1.6 of
FormMail contains a few minor bug fixes, optimized code and more comments.
The biggest change in this version is that by default, form fields are now
sorted as they appear in the form. Error pages were also beautified a
little and two new configuration fields were created. Read the History for
a more complete list of changes. Versions 1.7-1.9 were issues for security
fixes, and also fixed a problem causing selected servers to end the FormMail
process before the e-mail was sent. Although the fixes from 1.7 to 1.9 were
somewhat minor, they fixed major SPAM security holes and therefore the
version numbers were increased dramatically to reflect this change.
The script, FormMail.pl, needs to be placed in your server's cgi-bin and the
anonymous WWW user must have the ability to read/execute the script. If
you do not have access to your server's cgi-bin, yet you can execute cgi
scripts, you may want to try adding a .cgi extension to the FormMail.pl,
so you could rename it to FormMail.cgi.
Setting Up the FormMail Script:
===============================
The FormMail.pl script does not have to be extensively configured in order
to work. There are only two variables in the perl file which you will
need to define along with changing the top line of your script to match
the location of you Perl interpreter.
Necessary Variables:
--------------------
$mailprog = '/usr/lib/sendmail';
This variable must define the location to your server's sendmail
program. If this is incorrect, form results will not be mailed to you.
@referers = ('worldwidemart.com','206.31.72.203');
This array allows you to define the domains that you will allow
forms to reside on and use your FormMail script. If a user tries to
put a form on another server, that is not worldwidemart.com, they
will receive an error message when someone tries to fill out their form.
By placing worldwidemart.com in the @referers array, this also allows
www.worldwidemart.com, ftp.worldwidemart.com, any other http address
with worldwidemart.com in it and worldwidemart.com's IP address to access
this script as well, so no users will be turned away.
@recipients = @referers;
This is the most important variable you need to configure. It is an array
of all valid recipients that can be specified. In order for a form to be
submitted to the recipient defined in the form, the end of the recipient
e-mail address must match one of the elements in the recipients field.
For instance, as defined by default, @recipients = @referers, which means
@recipients holds 'worldwidemart.com' and '206.31.72.203' by default. If
the recipient form field is set to 'mattw@worldwidemart.com' or
'mattw@206.31.72.203' it will allow the e-mail to be sent. In fact, the
form could also be mailed to 'anyone@worldwidemart.com' or even
'anyone@anotherworldwidemart.com' as 'worldwidemart.com' which is defined
in @recipients matches the end of both of those e-mail addresses.
The most secure way to operate FormMail is to explicitly specify only those
e-mail addresses allowed. For instance:
@recipients = ('^mattw@worldwidemart.com','^joe@worldwidemart.com');
When specifying a complete e-mail address you should place a ^ at the
beginning. FormMail automatically requires that the recipient form field
match the end of one of @recipients, but by adding a ^, you are also
telling the perl regular expression parser that it must match the recipient
form field exactly (^ signifies the beginning of the field). So, if you
were hosting two domains yourname.com and someoneelse.com and wanted
FormMail to be able to send to anyone at yourname.com and only
joe@someoneelse.com, you should set @recipients to:
@recipients = ('yourname.com','^joe@someoneelse.com');
This means that any form with the recipient set to anything@yourname.com or
joe@someoneelse.com will be sent successfully. By default @recipients
is set to @referers so that e-mail can be sent to any domain the form can
be submitted from. This is decent protection, but for maximum protection
you can hardcode in each e-mail address that is allowed as a recipient.
If you are familiar with perl regular expressions, this is how these are
checked and whatever is entered in @recipients is required to match the end
of the recipient form field. So to allow e-mail to be sent to anyone on
yourserver with a username that is all letters, numbers or _, you could do:
@recipients = ('^\w+@yourserver.com');
If you are unfamiliar with perl regular expressions, decent protection is
to just set @recipients to the domains you wish e-mail to be sent to.
@valid_ENV = ('REMOTE_HOST','REMOTE_ADDR','REMOTE_USER','HTTP_USER_AGENT');
This new array allows the administrator to specify a list of environment
variables that the user may request be added into the e-mail. This is
a security patch that was advised against at:
http://www.securityfocus.com/bid/1187 and was implemented by
Peter D. Thompson Yezek at http://www.securityfocus.com/archive/1/62033
Only environment variables listed in this array may be included in the
form field env_report. So if you wanted to also know what URL they were
submitting from, you could change @valid_ENV to:
@valid_ENV = ('REMOTE_HOST','REMOTE_ADDR','REMOTE_USER',
'HTTP_USER_AGENT','HTTP_REFERER');
and then include HTTP_REFERER in your env_report form field.
Your FormMail program is now configured.
-----------------------------------------------------------------------------
Form Configuration:
===================
The action of your form needs to point towards this script (obviously), and
the method must be POST or GET in capital letters. Version 1.5 of FormMail
offers many new ways to code your form to tailor the resulting HTML page
and the way the script performs. Below is a list of form fields you can
use and how to implement them.
Necessary Form Fields:
======================
There is only one form field that you must have in your form, for
FormMail to work correctly. This is the recipient field.
Field: recipient
Description: This form field allows you to specify to whom you wish for your
form results to be mailed. Most likely you will want to
configure this option as a hidden form field with a value equal
to that of your e-mail address.
Syntax:
-----------------------------------------------------------------------------
Optional Form Fields:
=====================
Field: subject
Description: The subject field will allow you to specify the subject that you
wish to appear in the e-mail that is sent to you after this form
has been filled out. If you do not have this option turned on,
then the script will default to a message subject: WWW Form
Submission
Syntax:
If you wish to choose what the subject is:
To allow the user to choose a subject:
-----------------------------------------------------------------------------
Field: email
Description: This form field will allow the user to specify their return
e-mail address. If you want to be able to return e-mail to your
user, I strongly suggest that you include this form field and
allow them to fill it in. This will be put into the From:
field of the message you receive. If you want to require an
email address with valid syntax, add this field name to the
'required' field.
Syntax:
-----------------------------------------------------------------------------
Field: realname
Description: The realname form field will allow the user to input their real
name. This field is useful for identification purposes and will
also be put into the From: line of your message header.
Syntax:
-----------------------------------------------------------------------------
Field: redirect
Description: If you wish to redirect the user to a different URL, rather than
having them see the default response to the fill-out form, you
can use this hidden variable to send them to a pre-made HTML
page.
Syntax:
To choose the URL they will end up at:
To allow them to specify a URL they wish to travel to once the
form is filled out:
-----------------------------------------------------------------------------
Field: required
Version: 1.3 & Up
Description: You can now require for certain fields in your form to be filled
in before the user can successfully submit the form. Simply
place all field names that you want to be mandatory into this
field. If the required fields are not filled in, the user will
be notified of what they need to fill in, and a link back to
the form they just submitted will be provided.
To use a customized error page, see 'missing_fields_redirect'
Syntax:
If you want to require that they fill in the email and phone
fields in your form, so that you can reach them once you have
received the mail, use a syntax like:
-----------------------------------------------------------------------------
Field: env_report
Version: 1.3 & Up
Description: Allows you to have Environment variables included in the
e-mail message you receive after a user has filled out your
form. Useful if you wish to know what browser they were using,
what domain they were coming from or any other attributes
associated with environment variables. The following is a short
list of valid environment variables that might be useful:
REMOTE_HOST - Sends the hostname making a request.
REMOTE_ADDR - Sends the IP address of the remote host making
the request.
REMOTE_USER - If server supports authentication and script
is protected, this is the username they have
authenticated as. *This is not usually set.*
HTTP_USER_AGENT - The browser the client is using to send the
request.
There are others, but these are a few of the most useful. For
more information on environment variables, see:
http://www.cgi-resources.com/Documentation/Environment_Variables/
Syntax:
If you wanted to find the remote host and browser sending the
request, you would put the following into your form:
-----------------------------------------------------------------------------
Field: sort
Version: 1.4 & Up
Description: This field allows you to choose the order in which you wish
for your variables to appear in the e-mail that FormMail
generates. You can choose to have the field sorted
alphabetically or specify a set order in which you want the
fields to appear in your mail message. By leaving this field
out, the order will simply default to the order in which the
browsers sends the information to the script (which is usually
the exact same order as they appeared in the form.) When
sorting by a set order of fields, you should include the phrase
"order:" as the first part of your value for the sort field, and
then follow that with the field names you want to be listed in
the e-mail message, separated by commas. Version 1.6 allows a
little more flexibility in the listing of ordered fields, in
that you can include spaces and line breaks in the field without
it messing up the sort. This is helpful when you have many form
fields and need to insert a line wrap.
Syntax:
To sort alphabetically:
To sort by a set field order:
-----------------------------------------------------------------------------
Field: print_config
Version: 1.5 & Up
Description: print_config allows you to specify which of the config
variables you would like to have printed in your e-mail message.
By default, no config fields are printed to your e-mail. This
is because the important form fields, like email, subject, etc.
are included in the header of the message. However some users
have asked for this option so they can have these fields printed
in the body of the message. The config fields that you wish to
have printed should be in the value attribute of your input tag
separated by commas.
Syntax:
If you want to print the email and subject fields in the body of
your message, you would place the following form tag:
-----------------------------------------------------------------------------
Field: print_blank_fields
Version: 1.6
Description: print_blank_fields allows you to request that all form fields
are printed in the return HTML, regardless of whether or not
they were filled in. FormMail defaults to turning this off, so
that unused form fields aren't e-mailed.
Syntax:
If you want to print all blank fields:
----------------------------------------------------------------------------
Field: title
Version: 1.3 & Up
Description: This form field allows you to specify the title and header that
will appear on the resulting page if you do not specify a
redirect URL.
Syntax:
If you wanted a title of 'Feedback Form Results':
-----------------------------------------------------------------------------
Field: return_link_url
Version: 1.3 & Up
Description: This field allows you to specify a URL that will appear, as
return_link_title, on the following report page. This field
will not be used if you have the redirect field set, but it is
useful if you allow the user to receive the report on the
following page, but want to offer them a way to get back to
your main page.
Syntax:
-----------------------------------------------------------------------------
Field: return_link_title
Version: 1.3 & Up
Description: This is the title that will be used to link the user back to the
page you specify with return_link_url. The two fields will be
shown on the resulting form page as:
Syntax:
-----------------------------------------------------------------------------
Field: missing_fields_redirect
Version: 1.6
Description: This form field allows you to specify a URL that users will be
redirected to if there are fields listed in the required form
field that are not filled in. This is so you can customize an
error page instead of displaying the default.
Syntax:
-----------------------------------------------------------------------------
Field: background
Version: 1.3 & Up
Description: This form field allow you to specify a background image that
will appear if you do not have the redirect field set. This
image will appear as the background to the form results page.
Syntax:
-----------------------------------------------------------------------------
Field: bgcolor
Version: 1.3 & Up
Description: This form field allow you to specify a bgcolor for the form
results page in much the way you specify a background image.
This field should not be set if the redirect field is.
Syntax:
For a background color of White:
-----------------------------------------------------------------------------
Field: text_color
Version: 1.3 & Up
Description: This field works in the same way as bgcolor, except that it
will change the color of your text.
Syntax:
For a text color of Black:
-----------------------------------------------------------------------------
Field: link_color
Version: 1.3 & Up
Description: Changes the color of links on the resulting page. Works in the
same way as text_color. Should not be defined if redirect is.
Syntax:
For a link color of Red:
-----------------------------------------------------------------------------
Field: vlink_color
Version: 1.3 & Up
Description: Changes the color of visited links on the resulting page. Works
exactly the same as link_color. Should not be set if redirect
is.
Syntax:
For a visited link color of Blue:
-----------------------------------------------------------------------------
Field: alink_color
Version: 1.4 & Up
Description: Changes the color of active links on the resulting page. Works
exactly the same as link_color. Should not be set if redirect
is.
Syntax:
For a visited link color of Blue:
-----------------------------------------------------------------------------
Any other form fields that appear in your script will be mailed back to
you and displayed on the resulting page if you do not have the redirect
field set. There is no limit as to how many other form fields you can
use with this form, except the limits imposed by browsers and your server.
-----------------------------------------------------------------------------
Some of the possible uses of this script are:
1) You want to have a form that will be mailed to you, but aren't sure how to
write the CGI script for it.
2) You are the webmaster of your site and want to allow users to use forms,
but not to have their own cgi-bin directories, which can cause
security risks to your system. You can set this script up and then
allow all users to run off of it.
3) Want to have one script to parse all of your html forms and mail them
to you.
-----------------------------------------------------------------------------
Matt Wright - mattw@worldwidemart.com - http://www.worldwidemart.com/scripts/