diff options
| author | fishystock <215427190+fishystock@users.noreply.github.com> | 2026-08-08 23:35:11 -0400 |
|---|---|---|
| committer | fishystock <215427190+fishystock@users.noreply.github.com> | 2026-08-08 23:35:11 -0400 |
| commit | 504dacfe36dbb50eeb446c102e69c6fdec4a31fc (patch) | |
| tree | b5498004a47bc26d411a4e58552f8d6a6a8973d2 /templates/themes/staffapplication/staffapplicationpost.php | |
| parent | e19143f1a9430cd48bc6fc5ffd951bed7057531b (diff) | |
security: validate applicant email
Diffstat (limited to 'templates/themes/staffapplication/staffapplicationpost.php')
| -rw-r--r-- | templates/themes/staffapplication/staffapplicationpost.php | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/templates/themes/staffapplication/staffapplicationpost.php b/templates/themes/staffapplication/staffapplicationpost.php index 4d850cc2..6e27f932 100644 --- a/templates/themes/staffapplication/staffapplicationpost.php +++ b/templates/themes/staffapplication/staffapplicationpost.php @@ -23,13 +23,19 @@ if (isset ($_POST["antispam"])){ $message = wordwrap($message, 70, "\r\n"); $source = $emailcheck ? $email : $to; - $headers = 'From: ' . $source . "\r\n" . - 'Reply-To: ' . $source . "\r\n" . + + if(filter_var($source, FILTER_VALIDATE_EMAIL) && !preg_match('/[\r\n]/', $source)) { + $headers = 'From: ' . $source . "\r\n" . + 'Reply-To: ' . $source . "\r\n" . 'X-Mailer: PHP/' . phpversion(); - $sent = mail($to, $subject, $message, $headers); - $sentmessage = $sent ? "was submitted successfully.</p>\r\n" : "was unable to be submitted.</p>\r\n"; - $displaymessage = "<p style=\"text-align:center;\"> Your staff application " . $sentmessage; - } + $sent = mail($to, $subject, $message, $headers); + $sentmessage = $sent ? "was submitted successfully.</p>\r\n" : "was unable to be submitted.</p>\r\n"; + $displaymessage = "<p style=\"text-align:center;\"> Your staff application " . $sentmessage; + } + else { + $displaymessage = "<p style=\"text-align: center;\">INVALID EMAIL ADDRESS</p>"; + } + } } else |