Changeset 212 for trunk

Timestamp:

Dec 6, 2006 11:08:07 PM (17 years ago)

Author:

scdev

Message:

Q - added config for line endings and line length.

File:

• trunk/lib/Email.inc.php (modified) (3 diffs)

trunk/lib/Email.inc.php

@@ -40 +40 @@
         'subject' => null,
         'headers' => null,
-        'regex' => null
+        'regex' => null,
+        
+        // A single carriage return (\n) should terminate lines for locally injected mail.
+        // A carriage return + line-feed (\r\n) should be used if sending mail directly with SMTP.
+        'crlf' => "\n",
+        
+        // RFC 2822 says line length MUST be no more than 998 characters, and SHOULD be no more than 78 characters, excluding the CRLF.
+        // http://mailformat.dan.info/body/linelength.html
+        'wrap' => true,
+        'line_length' => 75,
     );
 
@@ -255 +264 @@
 
         // Wrap email text body, using _template_replaced if replacements have been used, or just a fresh _template if not.
-        $final_body = wordwrap(isset($this->_template_replaced) ? $this->_template_replaced : $this->_template);
+        $final_body = isset($this->_template_replaced) ? $this->_template_replaced : $this->_template;
+        if (false !== $this->getParam('wrap')) {
+            $final_body = wordwrap($final_body, $this->getParam('line_length'), $this->getParam('crlf'));            
+        }
 
         // Ensure all placeholders have been replaced. Find anything with {...} characters.
@@ -279 +291 @@
             $final_headers[] = sprintf('%s: %s', $key, $val);
         }
-        $final_headers = join("\r\n", $final_headers);
+        $final_headers = join($this->getParam('crlf'), $final_headers);
 
         // This is the address where delivery problems are sent to. We must strip off everything except the local@domain part.
-        $envelope_sender_header = sprintf('-f %s', preg_replace('/^.*<?([^\s@\[\]<>()]+\@[A-Za-z0-9.-]{1,}\.[A-Za-z]{2,5})>?$/iU', '$1', $this->_params['from']));
+        $envelope_sender_address = preg_replace('/^.*<?([^\s@\[\]<>()]+\@[A-Za-z0-9.-]{1,}\.[A-Za-z]{2,5})>?$/iU', '$1', $this->_params['from']);
+        if ('' != $envelope_sender_address && $this->validEmail($envelope_sender_address)) {
+            $envelope_sender_header = sprintf('-f %s', $envelope_sender_address);
+        } else {
+            $envelope_sender_header = '';            
+        }
 
         // Check for mail header injection attacks.
-        $full_mail_content = join("\n", array($final_to, $this->_params['subject'], $final_body, $final_headers, $envelope_sender_header));
-        if (preg_match("/(Content-Type:|MIME-Version:|Content-Transfer-Encoding:|[\n\r]Bcc:|[\n\r]Cc:)/i", $full_mail_content)) {
+        $full_mail_content = join($this->getParam('crlf'), array($final_to, $this->_params['subject'], $final_body));
+        if (preg_match("/(^|[\n\r])(Content-Type|MIME-Version|Content-Transfer-Encoding|Bcc|Cc):/i", $full_mail_content)) {
             $app->logMsg(sprintf('Mail header injection attack in content: %s', $full_mail_content), LOG_WARNING, __FILE__, __LINE__);
             sleep(3);