The Contact form in D6 allows users to enter information that will be displayed *above* the contact form, on the Contact page of the site. My users often use that to enter the company's direct contact details, such as address, and a general email address, for people who don't want to use the contact form.

Much to my surprise, I noticed that SpamSpan has no effect on email links entered here - ie., the links display totally unchanged. It looks as if SpamSpan is not filtering this content at all. Is that by design, or just an oversight?

Comments

lakka’s picture

lakka commented
Status: Active » Closed (works as designed)

Spamspan is a filter, and uses Drupal's filter capability to interecept email addresses in text entered by the user. But the contact module does not pass the relevant text through the filtering mechanism, perhaps because it is not expected that untrusted users will be editing that text.

You can either hack the contact.module (a quick look, untested, at the code suggests that replacing
filter_xss_admin(variable_get ...
in contact.pages.inc with
spamspan(filter_xss_admin(variable_get ...)
might do it), or you could raise a bug for that module.

Similar to this issue

icouto’s picture

icouto commented

Thank you for the follow up and clarification, lakka.

A bug report with the contact.module team has now been posted here:

http://drupal.org/node/307229