ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-20 03:33:39 +09:00
Code Issues Projects Releases Wiki Activity

fix(user): unify email validation for registration and settings (#39304)

Browse Source 
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Abhay Pratap Singh
2026-09-16 17:34:41 +00:00
committed by GitHub
co-authored by silverwind wxiaoguang
parent c6c671e113
commit 7ebb2caa9e
21 changed files with 138 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/mailer/sender/sendmail.go
+3 -8
View File
@@ -30,15 +30,10 @@ func (s *SendmailSender) Send(from string, to []string, msg io.WriterTo) error {
envelopeFrom = setting.MailService.EnvelopeFrom
}
args := []string{"-f", envelopeFrom, "-i"}
// Use "-t" to extract recipients from message headers, don't add email addresses to the command line.
// Because email address can start with "-" which can lead to injected command line argument (RCE)
args := []string{"-f", envelopeFrom, "-i", "-t"}
args = append(args, setting.MailService.SendmailArgs...)
for _, recipient := range to {
smtpTo, err := sanitizeEmailAddress(recipient)
if err != nil {
return fmt.Errorf("invalid recipient address %q: %w", recipient, err)
}
args = append(args, smtpTo)
}
log.Trace("Sending with: %s %v", setting.MailService.SendmailPath, args)
desc := fmt.Sprintf("SendMail: %s %v", setting.MailService.SendmailPath, args)