
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
A CKAN extension for adding popup contact forms to pages.
Borrows much of the contact form code from ckanext-surrey.
An example can be seen on the Natural History Museum's Data Portal when clicking "Contact dataset curator."
This extension now includes Google's reCAPTCHA for preventing spam submissions.
Path variables used below:
$INSTALL_FOLDER
(i.e. where CKAN is installed), e.g. /usr/lib/ckan/default
$CONFIG_FILE
, e.g. /etc/ckan/default/development.ini
pip install ckanext-contact
Clone the repository into the src
folder:
cd $INSTALL_FOLDER/src
git clone https://github.com/NaturalHistoryMuseum/ckanext-contact.git
Activate the virtual env:
. $INSTALL_FOLDER/bin/activate
Install via pip:
pip install $INSTALL_FOLDER/src/ckanext-contact
Installing from a pyproject.toml
in editable mode (i.e. pip install -e
) requires setuptools>=64
; however, CKAN 2.9 requires setuptools==44.1.0
. See our CKAN fork for a version of v2.9 that uses an updated setuptools if this functionality is something you need.
Add 'contact' to the list of plugins in your $CONFIG_FILE
:
ckan.plugins = ... contact
To use reCAPTCHA, you must register a site with the Google reCAPTCHA service and add your API key and secret in the configuration.
These are the options that can be specified in your .ini config file.
Name | Description | Default |
---|---|---|
ckanext.contact.mail_to | Email address to submit to | email_to |
ckanext.contact.recipient_name | Name of the recipient | ckan.site_title |
ckanext.contact.subject | Email subject for the submitted form | 'Contact/Question from visitor' |
ckanext.contact.add_timestamp_to_subject | Whether to append a timestamp to the subject line | false |
ckanext.contact.subject_prefix | A prefix to add to the subject before sending | '' |
Name | Description | Default |
---|---|---|
ckanext.contact.recaptcha_v3_key | API key for the reCAPTCHA service. | False (i.e. disabled) |
ckanext.contact.recaptcha_v3_secret | API secret for the reCAPTCHA service. | False (i.e. disabled) |
ckanext.contact.recaptcha_v3_action | data-module-action for the form/button |
Name | Description | Default |
---|---|---|
ckanext.contact.check_email | Set to False to disable checking email addresses via pyIsEmail | True (i.e. enabled) |
Add the following HTML where you want the contact button to appear:
{% set params = {...} %}
<a class="btn btn-primary" data-module="modal-contact" data-module-template="{{ h.get_contact_form_template_url(params) }}" href="{{ h.url_for('contact.form', **params) }}" title="{{ _('Contact') }}">
<i class="fas fa-envelope"></i>{{ link_text if link_text else _('CONTACT BUTTON TEXT') }}
</a>
{% asset 'ckanext-contact/main' %}
Where params
is a dict with three entries: package_id, resource_id, record_id (all of which are optional).
There is a Docker compose configuration available in this repository to make it easier to run tests. The ckan image uses the Dockerfile in the docker/
folder.
To run the tests against ckan 2.9.x on Python3:
Build the required images:
docker compose build
Then run the tests. The root of the repository is mounted into the ckan container as a volume by the Docker compose configuration, so you should only need to rebuild the ckan image if you change the extension's dependencies.
docker compose run ckan
FAQs
A CKAN extension for adding popup contact forms to pages.
We found that ckanext-contact demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.