From 504dacfe36dbb50eeb446c102e69c6fdec4a31fc Mon Sep 17 00:00:00 2001
From: fishystock <215427190+fishystock@users.noreply.github.com>
Date: Sat, 8 Aug 2026 23:35:11 -0400
Subject: security: validate applicant email

---
 .../themes/staffapplication/staffapplicationpost.php   | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

(limited to 'templates/themes/staffapplication')

diff --git a/templates/themes/staffapplication/staffapplicationpost.php b/templates/themes/staffapplication/staffapplicationpost.php
index 4d850cc2..6e27f932 100644
--- a/templates/themes/staffapplication/staffapplicationpost.php
+++ b/templates/themes/staffapplication/staffapplicationpost.php
@@ -23,13 +23,19 @@ if (isset ($_POST["antispam"])){
 		$message = wordwrap($message, 70, "\r\n");
 		
 		$source = $emailcheck ? $email : $to;
-		$headers = 'From: ' . $source . "\r\n" .
-			    'Reply-To: ' . $source . "\r\n" .
+
+		if(filter_var($source, FILTER_VALIDATE_EMAIL) && !preg_match('/[\r\n]/', $source)) {
+			$headers = 'From: ' . $source . "\r\n" .
+				'Reply-To: ' . $source . "\r\n" .
 				'X-Mailer: PHP/' . phpversion();
-		$sent = mail($to, $subject, $message, $headers);
-		$sentmessage = $sent ? "was submitted successfully.</p>\r\n" : "was unable to be submitted.</p>\r\n";
-		$displaymessage = "<p style=\"text-align:center;\"> Your staff application " . $sentmessage; 
-		}	
+			$sent = mail($to, $subject, $message, $headers);
+			$sentmessage = $sent ? "was submitted successfully.</p>\r\n" : "was unable to be submitted.</p>\r\n";
+			$displaymessage = "<p style=\"text-align:center;\"> Your staff application " . $sentmessage; 
+		}
+		else {
+			$displaymessage = "<p style=\"text-align: center;\">INVALID EMAIL ADDRESS</p>";
+		}
+	}	
 
 	}
 	else
-- 
cgit v1.3