From 696345b87b4f972cd6d9648074c4516ed6820aaf Mon Sep 17 00:00:00 2001 From: Maurits van Rees Date: Fri, 31 Jul 2026 19:51:42 +0200 Subject: [PATCH] Only send mail from contact-info on POST requests. See https://github.com/plone/Products.CMFPlone/issues/4360 Forward port of https://github.com/plone/Products.CMFPlone/pull/4361 --- news/4360.bugfix.md | 1 + src/Products/CMFPlone/browser/contact_info.py | 6 ++++++ src/Products/CMFPlone/tests/mails.txt | 9 +++++++++ 3 files changed, 16 insertions(+) create mode 100644 news/4360.bugfix.md diff --git a/news/4360.bugfix.md b/news/4360.bugfix.md new file mode 100644 index 0000000000..c78b4ef208 --- /dev/null +++ b/news/4360.bugfix.md @@ -0,0 +1 @@ +Only send mail from contact-info on POST requests. @mauritsvanrees diff --git a/src/Products/CMFPlone/browser/contact_info.py b/src/Products/CMFPlone/browser/contact_info.py index 438e4f9e76..5531f784be 100644 --- a/src/Products/CMFPlone/browser/contact_info.py +++ b/src/Products/CMFPlone/browser/contact_info.py @@ -44,6 +44,12 @@ def mailhost_is_configured(self): @button.buttonAndHandler(_("label_send", default="Send"), name="send") def handle_send(self, action): + if self.request.method != "POST": + # Only send on POST requests. + # See https://github.com/plone/Products.CMFPlone/issues/4360 + self.success = False + return + data, errors = self.extractData() if errors: IStatusMessage(self.request).add(self.formErrorsMessage, type="error") diff --git a/src/Products/CMFPlone/tests/mails.txt b/src/Products/CMFPlone/tests/mails.txt index fa292aef7b..db41ab1684 100644 --- a/src/Products/CMFPlone/tests/mails.txt +++ b/src/Products/CMFPlone/tests/mails.txt @@ -79,3 +79,12 @@ lines ending in different spots: >>> import quopri >>> quopri.decodestring(msg).replace(b'\n', b' ') b'...Another t\xc3\xa4st message...You are receiving this mail because T\xc3\xa4st user test@plone.test...is sending feedback about the site you administer at...' + +We should only send an email on a POST request. +See https://github.com/plone/Products.CMFPlone/issues/4360 + + >>> browser.open('http://nohost/plone/contact-info?form.buttons.send=1&form.widgets.sender_fullname=Maurits&form.widgets.sender_from_address=maurits@example.com&form.widgets.subject=Hello&form.widgets.message=Bye') + >>> browser.url.startswith('http://nohost/plone/contact-info') + True + >>> 'A mail has now been sent' in browser.contents + False