cvs: php-master-web /entry user-note.php

bjori Sun May 20 21:10:41 2007 UTC Modified files: /php-master-web/entry user-note.php Log: Check if "user" is valid email, if not strip all tags and \r \n (prevent mail header injection) http://cvs.php.net/viewvc.cgi/php-master-web/entry/user-note.php?r1=1.65&r2=1.66&diff_format=u Index: php-master-web/entry/user-note.php diff -u php-master-web/entry/user-note.php:1.65 php-master-web/entry/user-note.php:1.66 --- php-master-web/entry/user-note.php:1.65 Sun May 20 17:26:26 2007 +++ php-master-web/entry/user-note.php Sun May 20 21:10:41 2007 @@ -11,7 +11,19 @@ $mailto = 'php-notes@lists.php.net'; $failto = 'jimw@php.net, alindeman@php.net'; -$user = filter_input(INPUT_POST, "user", FILTER_SANITIZE_EMAIL); +function validateUser($user) { + $ret = filter_var($user, FILTER_VALIDATE_EMAIL); + + // If its not a valid email then strip all tags and \r & \n (since this will be used in the mail "from" header) / + if(!$ret) { + $ret = filter_var($user, FILTER_SANITIZE_STRIPPED, FILTER_FLAG_STRIP_HIGH); + $ret = str_replace(array("\r", "\n"), "", $ret); + } + return trim($res); +} + + +$user = filter_input(INPUT_POST, "user", FILTER_CALLBACK, array("filter" => FILTER_CALLBACK, "options" => "validateUser")); $note = filter_input(INPUT_POST, "note", FILTER_UNSAFE_RAW); $sect = filter_input(INPUT_POST, "sect", FILTER_SANITIZE_STRIPPED, FILTER_FLAG_STRIP_HIGH); $ip = filter_input(INPUT_POST, "ip", FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE|FILTER_FLAG_NO_RES_RANGE);