| @@ -72,16 +72,9 @@ | ||
| 72 | 72 | } |
| 73 | 73 | |
| 74 | 74 | public function to($email, $name = '') |
| 75 | 75 | { |
| 76 | - // wp_mail() splits a To string on commas, so a display name carrying a | |
| 77 | - // comma/semicolon injects extra recipients; angle brackets/quotes reframe | |
| 78 | - // the address and CR/LF inject headers. Strip them before building it. | |
| 79 | 76 | if ($name) { |
| 80 | - $name = trim(preg_replace('/[,;<>"\r\n\t]+/', ' ', $name)); | |
| 81 | - } | |
| 82 | - | |
| 83 | - if ($name) { | |
| 84 | 77 | $this->to = $name . ' <' . $email . '>'; |
| 85 | 78 | } else { |
| 86 | 79 | $this->to = $email; |
| 87 | 80 | } |
| @@ -131,27 +124,22 @@ | ||
| 131 | 124 | } else { |
| 132 | 125 | $headers[] = 'Content-Type: text/plain; charset=UTF-8'; |
| 133 | 126 | } |
| 134 | 127 | |
| 135 | - // A CR/LF in any header value starts an attacker-controlled header line. | |
| 136 | - $stripCrlf = function ($value) { | |
| 137 | - return str_replace(["\r", "\n"], '', $value); | |
| 138 | - }; | |
| 139 | - | |
| 140 | 128 | if ($this->from) { |
| 141 | - $headers[] = 'From: ' . $stripCrlf($this->from); | |
| 129 | + $headers[] = 'From: ' . $this->from; | |
| 142 | 130 | } |
| 143 | 131 | |
| 144 | 132 | if ($this->cc) { |
| 145 | - $headers[] = 'Cc: ' . $stripCrlf(implode(',', $this->cc)); | |
| 133 | + $headers[] = 'Cc: ' . implode(',', $this->cc); | |
| 146 | 134 | } |
| 147 | 135 | |
| 148 | 136 | if ($this->bcc) { |
| 149 | - $headers[] = 'Bcc: ' . $stripCrlf(implode(',', $this->bcc)); | |
| 137 | + $headers[] = 'Bcc: ' . implode(',', $this->bcc); | |
| 150 | 138 | } |
| 151 | 139 | |
| 152 | 140 | if ($this->replyTo) { |
| 153 | - $headers[] = 'Reply-To: ' . $stripCrlf($this->replyTo); | |
| 141 | + $headers[] = 'Reply-To: ' . $this->replyTo; | |
| 154 | 142 | } |
| 155 | 143 | |
| 156 | 144 | return wp_mail($this->to, $this->subject, $this->body, $headers); |
| 157 | 145 | } |
