nonsalant / contract

A signable contract that lives in a single file

Updates

🆕 12/31/23: Added functionality for shortcodes.

---

Single File Contract

A contract that lives in a single file and becomes static HTML after it's been signed.

1. Generate a contract file →
2. Upload it to your server
3. Send your client a link to it

• View demo

---

How it works

• Contract Generator →

1. Click the link above to create a contract file with custom content or HTML, a signature for the first party, and filename like contract-1234567890.php.
2. Upload the generated file to your own server or domain. You can also rename this file and put it in a folder with a unique name, eg: contract-1234567890/index.php.
3. Once signed by both parties, the PHP file will delete itself from your server and leave behind a static HTML file.

---

---

What's in each file

contract.php

An example of a contract script: contains all code (PHP, CSS, HTML, PNG-data, JS) required by a stand-alone contract file. Upon being signed, this script deletes itself (or rather, it deletes its .php file), and leaves behind an .html file with the same name: a final version of the contract, signed by both parties.

The first 10 or so lines of the file are used to store contract metadata (one per line), ie:

<?php /* ##########################
[client_email]
[dev_email]
[dev_signature]
[dev_ip]
[dev_timestamp]
[dev_timestamp_offset]
[dev_name]
[client_name]
###################################

---

test.php

A copy of contract.php -- the only difference is when the filename is test.php or demo.php the PHP file doesn't delete itself when signed.

---

📁/generator/

Folder containing all the code behind the online generator.

The Contract Generator can be downloaded by getting the generator.zip archive from the Releases section.

---

MIT License

contract's Issues

Emails not sending after both parties sign

Not sure how to configure this, but I am not receiving emails after the contract is signed.

404 after signing

I'm not sure what I'm doing wrong, but after signing I get a 404:

The requested URL /index.php was not found on this server.

Any ideas?

No Delete, Save PDF to Server?

Could this be modified easily to not delete the contract, then save or email the resulting PDF to the server/contact?

I have an idea for user training and doing completion sign-offs.

Laravel - VUEJS

Please rewrite to laravel plus vuejs (inertiajs)

contract.php can allow malicious code to be uploaded to the server

If an attacker knew the address of an installation of a contract, they could POST any HTML data via the contractdata field, writing it to the HTML file. An attacker could post a malicious piece of code, like an embedded PDF that exploits an Acrobat Reader bug, or an embedded SWF file that exploits a zero-day vulnerability. An attacker could also just post spam, defamatory content, or a page intended to phish user details (like a fake login form). Since the URL of the HTML file is known, the attacker could redirect users to the seemingly legitimate URL.

If an attacker knew what to search for, they could use Google to find publicly available instances of the software and automatically exploit them with a very small automated script.

It is also the case that some shared hosts are configured to execute files with the .html extension as PHP files. An attacker embedding PHP code in the contractdata field could compromise a whole server.

FTP Generate

Hi,

When i try and generate a new contract using the link provided in the readme, clicking the download contact button causes a 'Oops! That page can’t be found.' error.

Seems to be the download.php file cant be found.

It this something that can be fixed?

Also has the code for the generate contract been shared?

Thanks

Bobby.

Initial Bullet Points

An added feature that would be perfect is fields for initialing individual points. A waiver that I would like to digitize requires this.

I'll take a look at the source and maybe make a PR.