javaxman/NexStudio
1
0
Fork 0
Code Issues 3 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Elimina il falso successo del form contatti e mostra conferma invio. (#25)

Browse Source 
Rimuove l honeypot autofillato, rifiuta mode non-live in produzione e TO su pro@nexstudio.ai.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Javaxman
2026-07-29 17:34:26 +02:00
committed by GitHub
parent 03aabd29cc
commit 7f4bb2f184
6 changed files with 45 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/pages/api/contact.ts
View File

@ -129,14 +129,7 @@ export const POST: APIRoute = async ({ request, url }) => {
const turnstileSecret = readEnv('CONTACT_TURNSTILE_SECRET_KEY', runtimeEnv);
const form = await request.formData();
if (required(form.get('_gotcha'))) {
const redirectTarget =
sanitizeRedirect(required(form.get('_next')), url) ||
sanitizeRedirect(request.headers.get('referer') ?? '/', url) ||
new URL('/#contatti', url).toString();
return succeed(request, redirectTarget);
}
// Honeypot rimosso dal form (Turnstile basta). Se un client legacy lo manda, ignoralo.
const redirectTarget =
sanitizeRedirect(required(form.get('_next')), url) ||
sanitizeRedirect(readEnv('PUBLIC_CONTACT_FORM_SUCCESS_REDIRECT', runtimeEnv), url) ||
@ -239,6 +232,14 @@ export const POST: APIRoute = async ({ request, url }) => {
}
}
} else {
const isProdHost =
url.hostname === 'nexstudio.ai' ||
url.hostname.endsWith('.nexstudio.ai') ||
url.hostname.endsWith('.workers.dev');
console.warn('[contact] CONTACT_FORM_MODE is not live', { mode, host: url.hostname });
if (isProdHost) {
return fail(request, USER_SEND_ERROR, 503);
}
console.info('[contact:dev] Contact payload received', {
name,
company,