diff --git a/core/modules/contact/contact.pages.inc b/core/modules/contact/contact.pages.inc index bf096a7..50c6df7 100644 --- a/core/modules/contact/contact.pages.inc +++ b/core/modules/contact/contact.pages.inc @@ -76,6 +76,25 @@ function contact_site_form($form, &$form_state) { '#default_value' => $user->uid ? $user->mail : '', '#required' => TRUE, ); + + // Do not allow authenticated usrs to alter the name or e-mail values to + // prevent the impersonation of other users. + if ($user->uid){ + // Change form elements to values. + $form['name']['#type'] = $form['mail']['#type'] = 'value'; + + // Display read-only name and mail address to the user. + $form['name_display'] = array( + '#type' => 'item', + '#title' => t('Your name'), + '#markup' => user_format_name($user), + ); + $form['mail_display'] = array( + '#type' => 'item', + '#title' => t('Your e-mail address'), + '#markup' => $user->mail, + ); + } $form['subject'] = array( '#type' => 'textfield', '#title' => t('Subject'), @@ -95,8 +114,8 @@ function contact_site_form($form, &$form_state) { '#title' => t('Message'), '#required' => TRUE, ); - // We do not allow anonymous users to send themselves a copy - // because it can be abused to spam people. + // Do not allow anonymous users to send themselves a copy because it can be + // abused to spam people. $form['copy'] = array( '#type' => 'checkbox', '#title' => t('Send yourself a copy.'), @@ -212,6 +231,24 @@ function contact_personal_form($form, &$form_state, $recipient) { '#default_value' => $user->uid ? $user->mail : '', '#required' => TRUE, ); + // Do not allow authenticated users to alter the name or e-mail values to + // prevent the impersonation of other users. + if ($user->uid){ + // Change form elements to values. + $form['name']['#type'] = $form['mail']['#type'] = 'value'; + + // Display read-only name and mail address to the user. + $form['name_display'] = array( + '#type' => 'item', + '#title' => t('Your name'), + '#markup' => user_format_name($user), + ); + $form['mail_display'] = array( + '#type' => 'item', + '#title' => t('Your e-mail address'), + '#markup' => $user->mail, + ); + } $form['to'] = array( '#type' => 'item', '#title' => t('To'), @@ -229,7 +266,7 @@ function contact_personal_form($form, &$form_state, $recipient) { '#rows' => 15, '#required' => TRUE, ); - // We do not allow anonymous users to send themselves a copy + // Do not allow anonymous users to send themselves a copy // because it can be abused to spam people. $form['copy'] = array( '#type' => 'checkbox', @@ -259,6 +296,7 @@ function contact_personal_form_submit($form, &$form_state) { // Save the anonymous user information to a cookie for reuse. if (!$user->uid) { + $values['sender']->name .= ' (' . t('Unverified') . ')'; user_cookie_save(array_intersect_key($values, array_flip(array('name', 'mail')))); } diff --git a/core/modules/contact/contact.test b/core/modules/contact/contact.test index c80f21d..cd3acc2 100644 --- a/core/modules/contact/contact.test +++ b/core/modules/contact/contact.test @@ -177,6 +177,10 @@ class ContactSitewideTestCase extends WebTestBase { $this->addCategory('bar', 'bar@example.com', $bar_autoreply, FALSE); $this->addCategory('no_autoreply', 'bar@example.com', '', FALSE); + // Log the current user out in order to test the name and email fields. + $this->drupalLogout(); + user_role_grant_permissions(DRUPAL_ANONYMOUS_RID, array('access site-wide contact form')); + // Test the auto-reply for category 'foo'. $email = $this->randomName(32) . '@example.com'; $subject = $this->randomName(64); @@ -435,3 +439,36 @@ class ContactPersonalTestCase extends WebTestBase { $this->drupalPost('user/' . $account->uid . '/contact', $message, t('Send message')); } } + +/** + * Tests the contact form for authenticated users. + */ +class ContactAuthenticatedTestCase extends DrupalWebTestCase { + + public static function getInfo() { + return array( + 'name' => 'Contact form textfields.', + 'description' => 'Tests contact form textfields are present if authenticated', + 'group' => 'Contact', + ); + } + + function setUp() { + parent::setUp('contact'); + } + + /** + * Tests that name and email fields are not present for authenticated users. + */ + function testContactSiteWideTextfieldsLoggedInTestCase() { + $user = $this->drupalCreateUser(array('access site-wide contact form')); + $this->drupalLogin($user); + $this->drupalGet('contact'); + + // Ensure that there is no textfield for name. + $this->assertFalse($this->xpath('//input[@name=:name]', array(':name' => 'name'))); + + // Ensure that there is no textfield for email. + $this->assertFalse($this->xpath('//input[@name=:name]', array(':name' => 'mail'))); + } +}