2

I would like to disable access to specific profiles via their public URL, while still allowing HTML snippet access, i.e. I'd like to allow POST only. Is this possible?

We have fake spam contacts entering our database from https://secure.wildsight.ca/civicrm/profile/create?gid=56&reset=1. This profile is only used via HTML snippet on our other website and there is no need for it be available at this URL.

Disabling use of the profile for Standalone Form or Directory prevents any submissions from the snippet. ReCaptcha doesn't seem to be preventing these submissions.

Improve this question
2
  • If you can't sort out a redirect perhaps you could try civicrm.org/extensions/civihoneypot perhaps? and/or fail2ban. some good answers at civicrm.stackexchange.com/questions/2345/…
    – petednz - fuzion ♦
    Oct 22, 2020 at 2:22
  • 1
    CiviHoneyPot doesn't do profiles, unfortunately, just contribution and event pages. And I don't think fail2ban would do anything as it is just a few per day and generally spaced out. I'll see if I can make some of the suggestions in that question work.
    – Lars SG
    Oct 22, 2020 at 15:25

1 Answer 1

Reset to default
1

You could probably do it at the webserver level, e.g. in apache using <LocationMatch> and then <Limit>. Untested, and you might have to fiddle or put it in the right place for clean/non-clean urls, or for specific gid params:

<LocationMatch "^/civicrm/profile/create">
  <Limit GET>
    # allow just my own IP
    Require ip my.own.ip.address
  </Limit>
</LocationMatch>
Improve this answer
2
  • It's a shared server, so I can't do this directly, but I will see if I can get it implemented, thanks!
    – Lars SG
    Oct 22, 2020 at 15:28
  • If you're trying to limit what gets POSTed to the profile form, then I don't see that snippet as being useful. The only information available once it gets to the civicrm site is going to be the ip of the agent doing the posting and the referrer url which is spoofable anyway. Using the html snippet on a remote site is generally not advised and should be abandoned to use more sophisticated integrations.
    – Alan Dixon
    Nov 16, 2020 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.