tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-08-17 23:18:28 +00:00
Code Releases Activity

Prevent multiple To recipients (#22566) (#22569)

Browse Source 
Backport #22566

Change the mailer interface to prevent the leaking of possible hidden
email addresses when sending to multiple recipients.

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
Co-authored-by: Gusted <williamzijl7@hotmail.com>
This commit is contained in:
Yarden Shoham
2023-01-22 19:37:26 +02:00
committed by GitHub
parent c320caed97
commit 6068978c42
7 changed files with 23 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
services/mailer/mailer.go
View File

@@ -36,7 +36,7 @@ type Message struct {
Info string // Message information for log purpose.
FromAddress string
FromDisplayName string
To []string
To string // Use only one recipient to prevent leaking of addresses
Subject string
Date time.Time
Body string
@@ -47,7 +47,7 @@ type Message struct {
func (m *Message) ToMessage() *gomail.Message {
msg := gomail.NewMessage()
msg.SetAddressHeader("From", m.FromAddress, m.FromDisplayName)
msg.SetHeader("To", m.To...)
msg.SetHeader("To", m.To)
for header := range m.Headers {
msg.SetHeader(header, m.Headers[header]...)
}
@@ -86,7 +86,7 @@ func (m *Message) generateAutoMessageID() string {
dateMs := m.Date.UnixNano() / 1e6
h := fnv.New64()
if len(m.To) > 0 {
_, _ = h.Write([]byte(m.To[0]))
_, _ = h.Write([]byte(m.To))
}
_, _ = h.Write([]byte(m.Subject))
_, _ = h.Write([]byte(m.Body))
@@ -94,7 +94,7 @@ func (m *Message) generateAutoMessageID() string {
}
// NewMessageFrom creates new mail message object with custom From header.
func NewMessageFrom(to []string, fromDisplayName, fromAddress, subject, body string) *Message {
func NewMessageFrom(to, fromDisplayName, fromAddress, subject, body string) *Message {
log.Trace("NewMessageFrom (body):\n%s", body)
return &Message{
@@ -109,7 +109,7 @@ func NewMessageFrom(to []string, fromDisplayName, fromAddress, subject, body str
}
// NewMessage creates new mail message object with default From header.
func NewMessage(to []string, subject, body string) *Message {
func NewMessage(to, subject, body string) *Message {
return NewMessageFrom(to, setting.MailService.FromName, setting.MailService.FromEmail, subject, body)
}