[Web] Remove invalid chars from sender for quota and quarantine notifications

2019-09-15 09:52:13 +02:00
parent f9e7c6cf6a
commit 62a386f94e
2 changed files with 7 additions and 2 deletions
--- a/data/web/inc/functions.quota_notification.inc.php
+++ b/data/web/inc/functions.quota_notification.inc.php
@@ -21,7 +21,10 @@ function quota_notification($_action, $_data = null) {
        $release_format = 'raw';
      }
      $subject = $_data['subject'];
-      $sender = $_data['sender'];
+      $sender = preg_replace('/[\x00-\x1F\x80-\xFF]/', '', $_data['sender']);
+      if (filter_var($sender, FILTER_VALIDATE_EMAIL) === false) {
+        $sender = '';
+      }
      $html = $_data['html_tmpl'];
      try {
        $redis->Set('QW_SENDER', $sender);