The HelpsController allows non-logged in users to send a help email, and the required attribute on form elements ensures that the email is supplied.
However we've had a case where a bot discovered the form and submitted it, which generated a bunch of HelpsMailer Sidekiq jobs which failed, because the From address was not supplied (taken from the email input element).
Perhaps the controller should verify the input before sending off the email job?
The HelpsController allows non-logged in users to send a help email, and the
requiredattribute on form elements ensures that theemailis supplied.However we've had a case where a bot discovered the form and submitted it, which generated a bunch of HelpsMailer Sidekiq jobs which failed, because the
Fromaddress was not supplied (taken from theemailinput element).Perhaps the controller should verify the input before sending off the email job?
Here's an example of a Honeybadger notification:
https://app.honeybadger.io/projects/77112/faults/108352644
And the non-Shibboleth request that generated it:
Other request activity from that IP address makes it clear that it was a bot probing for vulnerabilities.