Version 5.0.13

applications/core/modules/front/contact/contact.php

@@ -15,6 +15,7 @@ namespace IPS\core\modules\front\contact;
 use IPS\Application;
 use IPS\Db;
 use IPS\Dispatcher\Controller;
+use IPS\File;
 use IPS\Helpers\Form;
 use IPS\Helpers\Form\Captcha;
 use IPS\Helpers\Form\Editor;
@@ -103,6 +104,9 @@ class contact extends Controller
 		
 		if ( $values = $form->values() )
 		{
+			/* Clear the autosave by claiming attachments */
+			File::claimAttachments( 'contact-' . Member::loggedIn()->member_id );
+
 			if ( ! Member::loggedIn()->member_id AND Settings::i()->contact_email_verify )
 			{
 				$key = Login::generateRandomString( 32 );
@@ -158,11 +162,14 @@ class contact extends Controller
 		/* Show interstitial page to prevent email clients from auto-verifying. */
 		Output::i()->sidebar['enabled'] = FALSE;
 		Output::i()->bodyClasses[] = 'ipsLayout_minimal';
-		
-		$form = new Form( 'form', NULL );
+
+		/* Strip out the key and email address values from the URL which will be urlcoded (%40) and will be encoded again when used in the form action (%2540) */
+		$form = new Form( 'form', NULL, Request::i()->url()->stripQueryString( [ 'key', 'email' ] ) );
 		$form->class = 'ipsForm--vertical ipsForm--contact-confirm';
-		$form->actionButtons[] = Theme::i()->getTemplate( 'forms', 'core', 'global' )->button( 'contact_click_to_verify', 'submit', null, 'ipsButton ipsButton_primary ipsButton_fullWidth', array( 'tabindex' => '2', 'accesskey' => 's' ) );
-		$form->hiddenValues['email'] = Request::i()->email;
+		$form->actionButtons[] = Theme::i()->getTemplate( 'forms', 'core', 'global' )->button( 'contact_click_to_verify', 'submit', null, 'ipsButton ipsButton--primary ipsButton--wide', array( 'tabindex' => '2', 'accesskey' => 's' ) );
+
+		/* The email address will still be encoded (%40) */
+		$form->hiddenValues['email'] = urldecode( Request::i()->email );
 		$form->hiddenValues['key'] = Request::i()->key;
 		
 		if ( $values = $form->values() )