|
1
|
<?php
|
|
2
|
|
|
3
|
/**
|
|
4
|
* @file
|
|
5
|
* Drupal core implementations of MailSystemInterface.
|
|
6
|
*/
|
|
7
|
|
|
8
|
/**
|
|
9
|
* The default Drupal mail backend using PHP's mail function.
|
|
10
|
*/
|
|
11
|
class DefaultMailSystem implements MailSystemInterface {
|
|
12
|
/**
|
|
13
|
* Concatenate and wrap the e-mail body for plain-text mails.
|
|
14
|
*
|
|
15
|
* @param $message
|
|
16
|
* A message array, as described in hook_mail_alter().
|
|
17
|
*
|
|
18
|
* @return
|
|
19
|
* The formatted $message.
|
|
20
|
*/
|
|
21
|
public function format(array $message) {
|
|
22
|
// Join the body array into one string.
|
|
23
|
$message['body'] = implode("\n\n", $message['body']);
|
|
24
|
// Convert any HTML to plain-text.
|
|
25
|
$message['body'] = drupal_html_to_text($message['body']);
|
|
26
|
// Wrap the mail body for sending.
|
|
27
|
$message['body'] = drupal_wrap_mail($message['body']);
|
|
28
|
return $message;
|
|
29
|
}
|
|
30
|
|
|
31
|
/**
|
|
32
|
* Send an e-mail message, using Drupal variables and default settings.
|
|
33
|
*
|
|
34
|
* @see http://php.net/manual/function.mail.php
|
|
35
|
* @see drupal_mail()
|
|
36
|
*
|
|
37
|
* @param $message
|
|
38
|
* A message array, as described in hook_mail_alter().
|
|
39
|
* @return
|
|
40
|
* TRUE if the mail was successfully accepted, otherwise FALSE.
|
|
41
|
*/
|
|
42
|
public function mail(array $message) {
|
|
43
|
// If 'Return-Path' isn't already set in php.ini, we pass it separately
|
|
44
|
// as an additional parameter instead of in the header.
|
|
45
|
// However, if PHP's 'safe_mode' is on, this is not allowed.
|
|
46
|
if (isset($message['headers']['Return-Path']) && !ini_get('safe_mode')) {
|
|
47
|
$return_path_set = strpos(ini_get('sendmail_path'), ' -f');
|
|
48
|
if (!$return_path_set) {
|
|
49
|
$message['Return-Path'] = $message['headers']['Return-Path'];
|
|
50
|
unset($message['headers']['Return-Path']);
|
|
51
|
}
|
|
52
|
}
|
|
53
|
$mimeheaders = array();
|
|
54
|
foreach ($message['headers'] as $name => $value) {
|
|
55
|
$mimeheaders[] = $name . ': ' . mime_header_encode($value);
|
|
56
|
}
|
|
57
|
$line_endings = variable_get('mail_line_endings', MAIL_LINE_ENDINGS);
|
|
58
|
// Prepare mail commands.
|
|
59
|
$mail_subject = mime_header_encode($message['subject']);
|
|
60
|
// Note: e-mail uses CRLF for line-endings. PHP's API requires LF
|
|
61
|
// on Unix and CRLF on Windows. Drupal automatically guesses the
|
|
62
|
// line-ending format appropriate for your system. If you need to
|
|
63
|
// override this, adjust $conf['mail_line_endings'] in settings.php.
|
|
64
|
$mail_body = preg_replace('@\r?\n@', $line_endings, $message['body']);
|
|
65
|
// For headers, PHP's API suggests that we use CRLF normally,
|
|
66
|
// but some MTAs incorrectly replace LF with CRLF. See #234403.
|
|
67
|
$mail_headers = join("\n", $mimeheaders);
|
|
68
|
|
|
69
|
// We suppress warnings and notices from mail() because of issues on some
|
|
70
|
// hosts. The return value of this method will still indicate whether mail
|
|
71
|
// was sent successfully.
|
|
72
|
if (!isset($_SERVER['WINDIR']) && strpos($_SERVER['SERVER_SOFTWARE'], 'Win32') === FALSE) {
|
|
73
|
// We validate the return path, unless it is equal to the site mail, which
|
|
74
|
// we assume to be safe.
|
|
75
|
if (isset($message['Return-Path']) && !ini_get('safe_mode') && (variable_get('site_mail', ini_get('sendmail_from')) === $message['Return-Path'] || self::_isShellSafe($message['Return-Path']))) {
|
|
76
|
// On most non-Windows systems, the "-f" option to the sendmail command
|
|
77
|
// is used to set the Return-Path. There is no space between -f and
|
|
78
|
// the value of the return path.
|
|
79
|
$mail_result = @mail(
|
|
80
|
$message['to'],
|
|
81
|
$mail_subject,
|
|
82
|
$mail_body,
|
|
83
|
$mail_headers,
|
|
84
|
'-f' . $message['Return-Path']
|
|
85
|
);
|
|
86
|
}
|
|
87
|
else {
|
|
88
|
// The optional $additional_parameters argument to mail() is not
|
|
89
|
// allowed if safe_mode is enabled. Passing any value throws a PHP
|
|
90
|
// warning and makes mail() return FALSE.
|
|
91
|
$mail_result = @mail(
|
|
92
|
$message['to'],
|
|
93
|
$mail_subject,
|
|
94
|
$mail_body,
|
|
95
|
$mail_headers
|
|
96
|
);
|
|
97
|
}
|
|
98
|
}
|
|
99
|
else {
|
|
100
|
// On Windows, PHP will use the value of sendmail_from for the
|
|
101
|
// Return-Path header.
|
|
102
|
$old_from = ini_get('sendmail_from');
|
|
103
|
ini_set('sendmail_from', $message['Return-Path']);
|
|
104
|
$mail_result = @mail(
|
|
105
|
$message['to'],
|
|
106
|
$mail_subject,
|
|
107
|
$mail_body,
|
|
108
|
$mail_headers
|
|
109
|
);
|
|
110
|
ini_set('sendmail_from', $old_from);
|
|
111
|
}
|
|
112
|
return $mail_result;
|
|
113
|
}
|
|
114
|
|
|
115
|
/**
|
|
116
|
* Disallows potentially unsafe shell characters.
|
|
117
|
*
|
|
118
|
* Functionally similar to PHPMailer::isShellSafe() which resulted from
|
|
119
|
* CVE-2016-10045. Note that escapeshellarg and escapeshellcmd are inadequate
|
|
120
|
* for this purpose.
|
|
121
|
*
|
|
122
|
* @param string $string
|
|
123
|
* The string to be validated.
|
|
124
|
*
|
|
125
|
* @return bool
|
|
126
|
* True if the string is shell-safe.
|
|
127
|
*
|
|
128
|
* @see https://github.com/PHPMailer/PHPMailer/issues/924
|
|
129
|
* @see https://github.com/PHPMailer/PHPMailer/blob/v5.2.21/class.phpmailer.php#L1430
|
|
130
|
*
|
|
131
|
* @todo Rename to ::isShellSafe() and/or discuss whether this is the correct
|
|
132
|
* location for this helper.
|
|
133
|
*/
|
|
134
|
protected static function _isShellSafe($string) {
|
|
135
|
if (escapeshellcmd($string) !== $string || !in_array(escapeshellarg($string), array("'$string'", "\"$string\""))) {
|
|
136
|
return FALSE;
|
|
137
|
}
|
|
138
|
if (preg_match('/[^a-zA-Z0-9@_\-.]/', $string) !== 0) {
|
|
139
|
return FALSE;
|
|
140
|
}
|
|
141
|
return TRUE;
|
|
142
|
}
|
|
143
|
|
|
144
|
}
|
|
145
|
|
|
146
|
/**
|
|
147
|
* A mail sending implementation that captures sent messages to a variable.
|
|
148
|
*
|
|
149
|
* This class is for running tests or for development.
|
|
150
|
*/
|
|
151
|
class TestingMailSystem extends DefaultMailSystem implements MailSystemInterface {
|
|
152
|
/**
|
|
153
|
* Accept an e-mail message and store it in a variable.
|
|
154
|
*
|
|
155
|
* @param $message
|
|
156
|
* An e-mail message.
|
|
157
|
*/
|
|
158
|
public function mail(array $message) {
|
|
159
|
$captured_emails = variable_get('drupal_test_email_collector', array());
|
|
160
|
$captured_emails[] = $message;
|
|
161
|
variable_set('drupal_test_email_collector', $captured_emails);
|
|
162
|
return TRUE;
|
|
163
|
}
|
|
164
|
}
|
|
165
|
|
