Changeset 490

Timestamp:

Sep 1, 2014 4:50:11 PM (10 years ago)

Author:

anonymous

Message:

Increased robustness of Email(); added envelope_sender_address param. Clarity in Validator class.

Location:

trunk/lib

Files:

• Email.inc.php (modified) (9 diffs)
• FormValidator.inc.php (modified) (1 diff)
• Validator.inc.php (modified) (3 diffs)

trunk/lib/Email.inc.php

@@ -61 +61 @@
         'subject' => null,
         'headers' => null,
+        'envelope_sender_address' => null, // AKA the bounce-to address. Will default to 'from' if left null.
         'regex' => null,
 
@@ -103 +104 @@
         . '[.-]?(?:[A-Z0-9]+[-.])*(?:[A-Z0-9]+\.)+[A-Z]{2,6}))'         // FALSE, matches domain name
         . '(?(1)'                                                       // Comment conditional for if initial < exists
-        . '(?:\s*>\s*|>\s+\([^,@]+\)\s*)'                                  // TRUE, ensure ending >
+        . '(?:\s*>\s*|>\s+\([^,@]+\)\s*)'                               // TRUE, ensure ending >
         . '|'
         . '(?:|\s*|\s+\([^,@]+\)\s*))$/i'));                            // FALSE ensure there is no ending >
@@ -129 +130 @@
             if (isset($params['from']) && !$this->validEmail($params['from'])) {
                 $params['from'] = null;
+            }
+            if (isset($params['envelope_sender_address']) && !$this->validEmail($params['envelope_sender_address'])) {
+                $params['envelope_sender_address'] = null;
             }
 
@@ -256 +260 @@
         // Use arguments if provided.
         if (isset($to)) {
-             $this->setParam(array('to' => $to));
+            $this->setParam(array('to' => $to));
         }
         if (isset($from)) {
-             $this->setParam(array('from' => $from));
+            $this->setParam(array('from' => $from));
         }
         if (isset($subject)) {
-             $this->setParam(array('subject' => $subject));
+            $this->setParam(array('subject' => $subject));
         }
         if (isset($headers)) {
-             $this->setParam(array('headers' => $headers));
+            $this->setParam(array('headers' => $headers));
         }
 
@@ -309 +313 @@
         $final_headers = array();
         foreach ($headers as $key => $val) {
-            if (empty($key) || empty($val) || !is_string($key) || !is_string($val)) {
+            // Validate key and values.
+            if (empty($key) || empty($val) || !is_string($key) || !is_string($val) || preg_match("/[\n\r]/", $key . $val) || preg_match('/[^\w-]/', $key)) {
                 $app->logMsg(sprintf('Broken headers provided: %s=%s', $key, $val), LOG_WARNING, __FILE__, __LINE__);
+                continue;
+            }
+            // If the envelope_sender_address was given as a header, move it to the correct place.
+            if ('envelope_sender_address' == $key) {
+                $this->_params['envelope_sender_address'] = isset($this->_params['envelope_sender_address']) ? $this->_params['envelope_sender_address'] : $val;
+                continue;
             }
             $final_headers[] = sprintf('%s: %s', $key, $val);
@@ -317 +328 @@
 
         // This is the address where delivery problems are sent to. We must strip off everything except the local@domain part.
-        $envelope_sender_address = preg_replace('/^.*<?([^\s@\[\]<>()]+\@[A-Za-z0-9.-]{1,}\.[A-Za-z]{2,5})>?$/iU', '$1', $this->_params['from']);
+        if (isset($this->_params['envelope_sender_address'])) {
+            $envelope_sender_address = sprintf('<%s>', trim($this->_params['envelope_sender_address'], '<>'));
+        } else {
+            $envelope_sender_address = preg_replace('/^.*<?([^\s@\[\]<>()]+\@[A-Za-z0-9.-]{1,}\.[A-Za-z]{2,5})>?$/iU', '$1', $this->_params['from']);
+        }
         if ('' != $envelope_sender_address && $this->validEmail($envelope_sender_address)) {
-            $envelope_sender_header = sprintf('-f %s', $envelope_sender_address);
-        } else {
-            $envelope_sender_header = '';
+            $additional_parameter = sprintf('-f %s', $envelope_sender_address);
+        } else {
+            $additional_parameter = '';
         }
 
@@ -328 +343 @@
         if (preg_match("/(^|[\n\r])(Content-Type|MIME-Version|Content-Transfer-Encoding|Bcc|Cc)\s*:/i", $full_mail_content)) {
             $app->logMsg(sprintf('Mail header injection attack in content: %s', $full_mail_content), LOG_WARNING, __FILE__, __LINE__);
-            sleep(3);
             return false;
         }
@@ -336 +350 @@
             $ret = mb_send_mail($final_to, $this->_params['subject'], $final_body, $final_headers);
         } else {
-            $ret = mb_send_mail($final_to, $this->_params['subject'], $final_body, $final_headers, $envelope_sender_header);
+            $ret = mb_send_mail($final_to, $this->_params['subject'], $final_body, $final_headers, $additional_parameter);
         }
 
@@ -344 +358 @@
             return true;
         } else {
-            $app->logMsg(sprintf('Email failure: %s, %s, %s, %s', $final_to, $this->_params['subject'], str_replace("\r\n", '\r\n', $final_headers), $envelope_sender_header), LOG_WARNING, __FILE__, __LINE__);
+            $app->logMsg(sprintf('Email failure: %s, %s, %s, %s', $final_to, $this->_params['subject'], str_replace("\r\n", '\r\n', $final_headers), $additional_parameter), LOG_WARNING, __FILE__, __LINE__);
             return false;
         }

trunk/lib/FormValidator.inc.php

@@ -276 +276 @@
     public function notEmpty($form_name, $msg='')
     {
-        if (Validator::notEmpty(getFormData($form_name))) {
+        if (!Validator::isEmpty(getFormData($form_name))) {
             return true;
         } else {

trunk/lib/Validator.inc.php

@@ -53 +53 @@
 
     /**
-     * Ensures a value is empty.
+     * Check if a value is not empty (just the opposite of isEmpty()).
      *
      * @param  string $val The input data to validate.
@@ -60 +60 @@
     static public function notEmpty($val)
     {
-        return '' != trim((string)$val);
-    }
-
-    /**
-     * Ensures a value is blank.
+        return !self::isEmpty($val);
+    }
+
+    /**
+     * Check if a value is empty.
      *
      * @param  string $val The input data to validate.
@@ -71 +71 @@
     static public function isEmpty($val)
     {
-        return '' == trim((string)$val);
+        if (is_array($val)) {
+            return empty($val);
+        } else {
+            return '' == trim((string)$val);
+        }
     }