From 3d0b6f4880e7ddb6e9c571ee480f9872ac688bb6 Mon Sep 17 00:00:00 2001
From: bernardhanna <bernard@matrixinternet.ie>
Date: Thu, 31 Jul 2025 09:44:17 +0100
Subject: [PATCH] form fixes

---
 .../Controllers/ContactFormController.php     | 33 ++++++++++---------
 resources/views/emails/en/contact.blade.php   |  2 +-
 resources/views/static/contact-us.blade.php   |  3 +-
 routes/web.php                                |  4 ++-
 4 files changed, 24 insertions(+), 18 deletions(-)

diff --git a/app/Http/Controllers/ContactFormController.php b/app/Http/Controllers/ContactFormController.php
index 9f6a5edd9..0366b79ac 100644
--- a/app/Http/Controllers/ContactFormController.php
+++ b/app/Http/Controllers/ContactFormController.php
@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Http\Controllers;
 
 use Illuminate\Http\Request;
@@ -10,6 +11,12 @@ class ContactFormController extends Controller
 {
     public function submit(Request $request)
     {
+        // Honeypot field: bot filled
+        if ($request->filled('website')) {
+            Log::warning('Spam detected: honeypot field filled', ['ip' => $request->ip()]);
+            abort(403, 'Spam detected.');
+        }
+
         $validated = $request->validate([
             'first_name' => 'required|string|max:255',
             'last_name'  => 'required|string|max:255',
@@ -21,7 +28,7 @@ public function submit(Request $request)
             'cf-turnstile-response' => env('TURNSTILE_SECRET_KEY') ? 'required' : 'nullable',
         ]);
 
-        // Validate Turnstile CAPTCHA if keys are present
+        // Verify CAPTCHA via Cloudflare Turnstile
         if (env('TURNSTILE_SECRET_KEY')) {
             $response = Http::asForm()->post('https://challenges.cloudflare.com/turnstile/v0/siteverify', [
                 'secret'   => env('TURNSTILE_SECRET_KEY'),
@@ -30,31 +37,27 @@ public function submit(Request $request)
             ]);
 
             if (!$response->json('success')) {
-                return redirect()->back()
+                return back()
                     ->withInput()
                     ->withErrors(['captcha' => 'CAPTCHA verification failed. Please try again.']);
             }
         }
 
-        Log::info('Contact form submitted', $validated);
+        Log::info('Contact form submitted', [
+            'ip' => $request->ip(),
+            'name' => $validated['first_name'] . ' ' . $validated['last_name'],
+            'email' => $validated['email'],
+        ]);
 
         $locale = app()->getLocale();
-        $view = "emails.$locale.contact";
-
-        // Fallback to English view if the localized one doesn't exist
-        if (!view()->exists($view)) {
-            $view = 'emails.en.contact';
-        }
-
-        // Use email from .env, fallback to your address if missing
-        $recipientEmail = env('CONTACT_FORM_RECIPIENT_EMAIL', 'bernard@matrixinternet.ie');
+        $view = view()->exists("emails.$locale.contact") ? "emails.$locale.contact" : 'emails.en.contact';
 
-        Mail::send($view, ['data' => $validated], function ($message) use ($validated, $recipientEmail) {
-            $message->to($recipientEmail)
+        Mail::send($view, ['data' => $validated], function ($message) use ($validated) {
+            $message->to(env('CONTACT_FORM_RECIPIENT_EMAIL', 'bernard@matrixinternet.ie'))
                     ->subject('New Contact Form Submission')
                     ->replyTo($validated['email'], $validated['first_name'] . ' ' . $validated['last_name']);
         });
 
-        return redirect()->back()->with('success', 'Thank you for contacting us.');
+        return back()->with('success', 'Thank you for contacting us.');
     }
 }
diff --git a/resources/views/emails/en/contact.blade.php b/resources/views/emails/en/contact.blade.php
index 0c0636825..bd10aa9ba 100644
--- a/resources/views/emails/en/contact.blade.php
+++ b/resources/views/emails/en/contact.blade.php
@@ -10,4 +10,4 @@
     <p><strong>Subject:</strong> {{ ucfirst($data['subject']) }}</p>
 @endif
 <p><strong>Message:</strong></p>
-<p>{{ nl2br(e($data['message'])) }}</p>
+<p>{!! nl2br(e($data['message'])) !!}</p>
diff --git a/resources/views/static/contact-us.blade.php b/resources/views/static/contact-us.blade.php
index 0e828d284..486a054b6 100644
--- a/resources/views/static/contact-us.blade.php
+++ b/resources/views/static/contact-us.blade.php
@@ -160,7 +160,7 @@ class="w-full px-6 py-3 rounded-3xl border-2 border-[#A4B8D9] bg-white appearanc
                         <textarea id="message" name="message" rows="6" required aria-required="true" placeholder="Enter message"
                             class="mt-2 px-6 py-3 w-full bg-white rounded-3xl border-2 border-[#A4B8D9] text-slate-600 placeholder-slate-200 focus:outline-none focus:ring-2 focus:ring-primary resize-none">{{ old('message') }}</textarea>
                     </div>
-
+                    
                     <!-- Terms -->
                     <label class="flex gap-2 items-start mt-10 cursor-pointer lg:items-center">
                         <input type="checkbox" id="terms" name="terms" required aria-required="true"
@@ -176,6 +176,7 @@ class="w-8 h-8 bg-white rounded-lg border-2 border-blue-800 text-primary focus:r
                   <div class="flex justify-center mt-6">
                         <div class="cf-turnstile"></div>
                         <input type="hidden" id="cf-turnstile-response" name="cf-turnstile-response" />
+                        <input type="text" name="website" style="display:none;" tabindex="-1" autocomplete="off">
                     </div>
 
                     <!-- Submit -->
diff --git a/routes/web.php b/routes/web.php
index 8fec23a4f..0c537f70b 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -305,7 +305,9 @@
     '/training/making-and-coding',
     [StaticPageController::class, 'static']
 )->name('training.module-22'); */
-Route::post('/contact-submit', [ContactFormController::class, 'submit'])->name('contact.submit');
+Route::post('/contact-submit', [ContactFormController::class, 'submit'])
+    ->middleware('throttle:5,1') // 5 requests per minute per IP
+    ->name('contact.submit');
 Route::get('/resources/CodingAtHome', [CodingAtHomeController::class, 'show'])->name(
     'coding@home'
 );