1 Release 247 Tags

RSS Feed

• v2.4.60 99467f1379

  Compare

  v2.4.60 — Anti-spam hardening Stable

  mmintel released this 2026-09-02 08:06:07 +00:00 | 1 commits to main since this release

  Anti-spam hardening for the contact form

  The previous spam guard (v2.4.59 era) could still be bypassed and silently blocked legitimate quote requests. This release fixes both:

  Fixes

  • Proxy-safe IP extraction: rate limiting now uses the last X-Forwarded-For hop (appended by Traefik) instead of the client-controlled first hop, which bots rotated freely to evade the rate limit
  • Server-anchored time-trap: the fill-time check is now backed by an HMAC-signed form token (FORM_TOKEN_SECRET, 24h validity, timing-safe comparison) instead of the client-supplied form_loaded_at timestamp
  • RequestQuoteForm regression: FormData was built from scratch without the honeypot/token hidden inputs and inputs lacked name attributes, so every legitimate product quote request was silently swallowed as spam

  New modules

  • lib/antispam/form-token.ts — signed token issue/verify
  • lib/antispam/client-ip.ts — XFF parsing

  Ops notes

  • Set FORM_TOKEN_SECRET in the production .env before/with this deploy
  • Tests: 19 antispam specs green, typecheck clean

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)