Преглед изворни кода

Add validation on reply_to headers in api_mail_html() - refs BT#15186

Yannick Warnier пре 6 година
родитељ
комит
7718477974
1 измењених фајлова са 10 додато и 8 уклоњено
  1. 10 8
      main/inc/lib/api.lib.php

+ 10 - 8
main/inc/lib/api.lib.php

@@ -8774,14 +8774,16 @@ function api_mail_html(
 
     // Reply to first
     if (isset($extra_headers['reply_to']) && empty($platform_email['SMTP_UNIQUE_REPLY_TO'])) {
-        $mail->AddReplyTo(
-            $extra_headers['reply_to']['mail'],
-            $extra_headers['reply_to']['name']
-        );
-        // Errors to sender
-        $mail->AddCustomHeader('Errors-To: '.$extra_headers['reply_to']['mail']);
-        $mail->Sender = $extra_headers['reply_to']['mail'];
-        unset($extra_headers['reply_to']);
+        if (PHPMailer::validateAddress($extra_headers['reply_to']['mail'])) {
+            $mail->AddReplyTo(
+                $extra_headers['reply_to']['mail'],
+                $extra_headers['reply_to']['name']
+            );
+            // Errors to sender
+            $mail->AddCustomHeader('Errors-To: '.$extra_headers['reply_to']['mail']);
+            $mail->Sender = $extra_headers['reply_to']['mail'];
+            unset($extra_headers['reply_to']);
+        }
     } else {
         $mail->AddCustomHeader('Errors-To: '.$defaultEmail);
     }