bryzgalov/cf7-spam-to-telegram
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: phone leak, field-by-value detection, strict Flamingo email fallback

Browse Source 
Three pilot-surfaced issues in one pass:

1. PhoneParser regex used '\s' in the candidate character class, so a
   digit on a following flattened line bled into the phone. '+7977
   6277470\n1' (phone + trailing checkbox value) parsed as 12 digits,
   producing '+797762774701'. Replaced '\s' with a literal space so
   newlines/tabs stop the candidate.

2. Custom-themed forms don't use 'your-name' / 'your-email' keys
   (washanyanya.ru has text-211 / text-212 / name_user). Added
   FieldDetector::find_name + find_email as fallbacks. Classifier
   and MessageFormatter now call them if no standard key matches,
   so 'Александр' in text-211 is recognised as a cyrillic name and
   scored / displayed accordingly.

3. FlamingoHelper copied '_from_email' into 'your-email' without
   validating it. Flamingo derives that meta from whatever field it
   considers "first"; on phone-first forms it ends up holding the
   phone number. Now we only copy _from_email if it contains '@',
   and dropped the _from_name shortcut entirely — FieldDetector
   handles the name via the actual field values.

Tests: +1 FieldDetectorTest (13 cases); +2 PhoneParserTest cases for
newline/tab bleeds; +1 ClassifierTest case; +1 MessageFormatterTest
case for custom field keys. Full suite 53/53 green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Vladimir Bryzgalov
2026-04-18 00:22:39 +05:00
parent dbdfc9afa9
commit 8efb82ca43
11 changed files with 283 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/plans/2026-04-17-cf7-spam-to-telegram.md
+20 -6
View File
@@ -446,7 +446,12 @@ final class PhoneParser
// Find a run of digits, spaces, dashes, parens, dots and a leading '+',
// with at least 10 digits in total. Walk candidates left-to-right and
// pick the first that yields 10 or 11 digits.
if (!preg_match_all('/\+?[\d][\d\s().\-]{8,}/u', $text, $m)) {
// NOTE: the space class is a literal ' ' — not '\s'. If '\s' is used
// a newline or tab between two adjacent form fields (phone value,
// then checkbox value) would bleed into the phone and append extra
// digits. MessageFormatter/Classifier flatten fields with "\n" before
// calling us, so this matters in practice.
if (!preg_match_all('/\+?[\d][\d ().\-]{8,}/u', $text, $m)) {
return null;
}
@@ -755,7 +760,9 @@ final class Classifier
$text_all = self::concat_fields($fields);
$name = self::pick_field($fields, ['your-name', 'name', 'имя', 'fio']);
if ($name === '') $name = FieldDetector::find_name($fields);
$email = self::pick_field($fields, ['your-email', 'email', 'e-mail', 'mail']);
if ($email === '') $email = FieldDetector::find_email($fields);
$message = self::pick_field($fields, ['your-message', 'message', 'comment', 'сообщение', 'вопрос']);
$score = 0;
@@ -1142,7 +1149,9 @@ final class MessageFormatter
$phone = PhoneParser::parse(self::flatten_fields_for_phone($fields));
$name = self::pick($fields, ['your-name', 'name', 'имя', 'fio']);
if ($name === '') $name = FieldDetector::find_name($fields);
$email = self::pick($fields, ['your-email', 'email', 'e-mail', 'mail']);
if ($email === '') $email = FieldDetector::find_email($fields);
$message = self::pick($fields, ['your-message', 'message', 'comment', 'сообщение', 'вопрос']);
$lines = [];
@@ -1941,12 +1950,17 @@ final class FlamingoHelper
$out[$name] = $val;
}
}
// Convenience: expose Akismet's "from" name / email so the formatter's
// standard slots aren't empty for most submissions.
$from_name = (string)get_post_meta($post->ID, '_from_name', true);
// Flamingo's "_from_name" and "_from_email" are derived heuristically
// from whatever field the plugin considers the "first" — on custom
// forms without dedicated email / name fields this produces garbage
// (e.g. phone number under _from_email). Only trust _from_email if
// it actually looks like an email; _from_name is not trustworthy at
// all, so leave it to FieldDetector (run by Classifier / Message-
// Formatter) to identify a name from any field value.
$from_email = (string)get_post_meta($post->ID, '_from_email', true);
if ($from_name !== '' && !isset($out['your-name'])) $out['your-name'] = $from_name;
if ($from_email !== '' && !isset($out['your-email'])) $out['your-email'] = $from_email;
if ($from_email !== '' && strpos($from_email, '@') !== false && !isset($out['your-email'])) {
$out['your-email'] = $from_email;
}
return $out;
}
docs/superpowers/specs/2026-04-17-cf7-spam-to-telegram-design.md
+9 -1
View File
@@ -63,7 +63,8 @@ cf7-spam-to-telegram/
│ ├── class-classifier.php # Эвристика, score → label, reasons
│ ├── class-phone-parser.php # Нормализация RU-телефонов
│ ├── class-domain-formatter.php # Punycode → кириллица (idn_to_utf8)
│ ├── class-message-formatter.php # Сборка HTML-сообщения, inline-клавиатура
│ ├── class-field-detector.php # Fallback поиск имени/email когда ключи формы нестандартны
│ ├── class-message-formatter.php # Сборка HTML-сообщения
│ ├── class-retro-importer.php # Ретро-выгрузка из Flamingo
│ ├── class-flamingo-helper.php # Извлечение полей и reason из Flamingo
│ └── sources/
@@ -221,6 +222,13 @@ apply_filters('cf7stg_classifier_keywords', $default_keywords);
apply_filters('cf7stg_classifier_thresholds', ['client' => 3, 'spam' => -2]);
```
**Поиск полей формы.** Сначала пробуются известные CF7-ключи — `your-name`, `name`, `имя`, `fio` для имени; `your-email`, `email`, `e-mail`, `mail` для e-mail; `your-message`, `message`, `comment`, `сообщение`, `вопрос` для текста. Если ничего не нашлось (например, на сайте форма с кастомными именами полей `text-211`, `name_user` и т.п.), подключается `FieldDetector`:
- `find_name(fields)` — первое значение без цифр/URL/@, длиной 2..80, состоящее только из letter-characters (любой скрипт), пробелов, дефисов и апострофов.
- `find_email(fields)` — первое значение, матчащее `^\S+@\S+\.\S+$`.
Телефон всегда ищется `PhoneParser::parse()` по конкатенации всех полей — имена ключей не важны.
## 9. MessageFormatter — формат сообщения в Telegram
- **parse_mode:** `HTML` (строже и предсказуемее, чем MarkdownV2).