WordPress.org

Make WordPress Core

Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#37548 closed defect (bug) (duplicate)

wp_mail can result in improperly formatted domain when using default 'from' address

Reported by: cklosows Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Mail Keywords:
Focuses: Cc:
PR Number:

Description

As it stands the wp_mail function has a method to fall back onto wordpress@example.org (replace example.org with the sites domain) when no 'From' email address is provided, however the use of $_SERVER['SERVER_NAME'] can result in an invalid domain being used, causing a fatal error when performing actions like creating a new site in Multisite.

For instance, in my local development with nginx the $_SERVER['SERVER_NAME'] is being reported as ~^(.*).edd\\.dev$ when requested, in order to handle some multisite configurations.

Since this super global can be configured differently in different environments, it should be sanitized or checked before trying to use it. There have been some tickets in the past that have raised concerns here and I'm not opposed to the SERVER_NAME approach, but there should be a fallback if that is not a valid option. Locally I have the following added (I can work up a patch later if anyone is interested):

if ( ! filter_var( $sitename, FILTER_VALIDATE_URL ) ) {
	$sitename = preg_replace( '#^http(s)?://#', '', get_home_url() );
}

Change History (4)

#1 @cklosows
3 years ago

In context, this is the section I've modified:

	if ( !isset( $from_email ) ) {
		// Get the site domain and get rid of www.
		$sitename = strtolower( $_SERVER['SERVER_NAME'] );
		if ( substr( $sitename, 0, 4 ) == 'www.' ) {
			$sitename = substr( $sitename, 4 );
		}

		if ( ! filter_var( $sitename, FILTER_VALIDATE_URL ) ) {
			$sitename = preg_replace( '#^http(s)?://#', '', get_home_url() );
		}

		$from_email = 'wordpress@' . $sitename;
	}

#2 @ocean90
3 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to duplicate
  • Status changed from new to closed
  • Version trunk deleted

Duplicate of #25239.

#3 follow-up: @cklosows
3 years ago

Sorry about that @ocean90, didn't see that one in the suggestions as I typed up the title. :+1:

#4 in reply to: ↑ 3 @ocean90
3 years ago

Replying to cklosows:

Sorry about that @ocean90, didn't see that one in the suggestions as I typed up the title. :+1:

The search index is currently broken, see #meta1635. 😞

Note: See TracTickets for help on using tickets.