// ============================================================================= // contact.php ; Contact page (display + form handling) // ============================================================================= // **************************************************** // CHANGE LOG // *************************************************** //* // * @author gail // * @since 25/06/2026 // * @purpose Improve security to prevent message flooding // * @change compliments of 'Claude' // SECURITY CHANGES (summary): // 1. session_start() kept here; cont_mail.php also guards with // session_status() so there is no double-start conflict. // 2. CSRF token generated here and embedded in the form as a hidden field. // 3. Dangerous extract($errors) replaced with explicit variable assignments. // 4. Session error array cleared after being read to prevent stale errors // appearing on a subsequent fresh page load. // 5. $sent flag hardened � only exact string 'sent' is accepted. // ============================================================================= // ----------------------------------------------------------------------------- // CHANGE 2: Generate a CSRF token if one does not already exist in the session. // The token is a cryptographically random 32-byte hex string. // It is embedded in the form (see hidden input below) and verified // in cont_mail.php before any processing takes place. // -----------------------------------------------------------------------------