Ticket #25239: CVE-2017-8295.patch

wp-includes/pluggable.php

@@ -323 +323 @@
 
         if ( !isset( $from_email ) ) {
                 // Get the site domain and get rid of www.
-                $sitename = strtolower( $_SERVER['SERVER_NAME'] );
-                if ( substr( $sitename, 0, 4 ) == 'www.' ) {
-                        $sitename = substr( $sitename, 4 );
-                }
-
+                $sitename = parse_url( network_home_url(), PHP_URL_HOST );
+                
                 $from_email = 'wordpress@' . $sitename;
         }
 
@@ -1491 +1488 @@
                 $notify_message .= sprintf( __( 'Spam it: %s' ), admin_url( "comment.php?action=spam&c={$comment->comment_ID}#wpbody-content" ) ) . "\r\n";
         }
 
-        $wp_email = 'wordpress@' . preg_replace('#^www\.#', '', strtolower($_SERVER['SERVER_NAME']));
+        $wp_email = 'wordpress@' . parse_url(network_home_url(), PHP_URL_HOST);
 
         if ( '' == $comment->comment_author ) {
                 $from = "From: \"$blogname\" <$wp_email>";