L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-58038 email: make sure all allowedemaildomain entries are respected

Browse Source 
Fixes a bug with exploding the config var, in which trailing carriage
returns were causing string matches to fail.
This commit is contained in:
Jake Dallimore
2017-02-28 12:17:52 +08:00
parent 0f59b6dd75
commit 9e44cec27f
2 changed files with 97 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/moodlelib.php
+8 -13
View File
@@ -5811,23 +5811,13 @@ function email_to_user($user, $from, $subject, $messagetext, $messagehtml = '',
$replyto = $noreplyaddress;
}
$alloweddomains = null;
if (!empty($CFG->allowedemaildomains)) {
$alloweddomains = explode(PHP_EOL, $CFG->allowedemaildomains);
}
// Email will be sent using no reply address.
if (empty($alloweddomains)) {
$usetrueaddress = false;
}
if (is_string($from)) { // So we can pass whatever we want if there is need.
$mail->From = $noreplyaddress;
$mail->FromName = $from;
// Check if using the true address is true, and the email is in the list of allowed domains for sending email,
// and that the senders email setting is either displayed to everyone, or display to only other users that are enrolled
// in a course with the sender.
} else if ($usetrueaddress && can_send_from_real_email_address($from, $user, $alloweddomains)) {
} else if ($usetrueaddress && can_send_from_real_email_address($from, $user)) {
if (!validate_email($from->email)) {
debugging('email_to_user: Invalid from-email '.s($from->email).' - not sending');
// Better not to use $noreplyaddress in this case.
@@ -6063,10 +6053,15 @@ function email_to_user($user, $from, $subject, $messagetext, $messagehtml = '',
*
* @param object $from The user object for the user we are sending the email from.
* @param object $user The user object that we are sending the email to.
* @param array $alloweddomains An array of allowed domains that we can send email from.
* @param array $unused No longer used.
* @return bool Returns true if we can use the from user's email adress in the "From" field.
*/
function can_send_from_real_email_address($from, $user, $alloweddomains) {
function can_send_from_real_email_address($from, $user, $unused = null) {
global $CFG;
if (!isset($CFG->allowedemaildomains) || empty(trim($CFG->allowedemaildomains))) {
return false;
}
$alloweddomains = array_map('trim', explode("\n", $CFG->allowedemaildomains));
// Email is in the list of allowed domains for sending email,
// and the senders email setting is either displayed to everyone, or display to only other users that are enrolled
// in a course with the sender.
lib/tests/moodlelib_test.php
+89 -25
View File
@@ -2793,7 +2793,7 @@ class core_moodlelib_testcase extends advanced_testcase {
$user1 = $this->getDataGenerator()->create_user(array('maildisplay' => 1));
$user2 = $this->getDataGenerator()->create_user(array('maildisplay' => 1));
$user3 = $this->getDataGenerator()->create_user(array('maildisplay' => 0));
set_config('allowedemaildomains', 'example.com');
set_config('allowedemaildomains', "example.com\r\nmoodle.org");
$subject = 'subject';
$messagetext = 'message text';
@@ -3366,17 +3366,17 @@ class core_moodlelib_testcase extends advanced_testcase {
* @param string $email Email address for the from user.
* @param int $display The user's email display preference.
* @param bool $samecourse Are the users in the same course?
* @param string $config The CFG->allowedemaildomains config values
* @param bool $result The expected result.
* @dataProvider data_can_send_from_real_email_address
*/
public function test_can_send_from_real_email_address($email, $display, $samecourse, $result) {
global $DB;
public function test_can_send_from_real_email_address($email, $display, $samecourse, $config, $result) {
$this->resetAfterTest();
$fromuser = $this->getDataGenerator()->create_user();
$touser = $this->getDataGenerator()->create_user();
$course = $this->getDataGenerator()->create_course();
$alloweddomains = ['example.com'];
set_config('allowedemaildomains', $config);
$fromuser->email = $email;
$fromuser->maildisplay = $display;
@@ -3386,7 +3386,7 @@ class core_moodlelib_testcase extends advanced_testcase {
} else {
$this->getDataGenerator()->enrol_user($fromuser->id, $course->id, 'student');
}
$this->assertEquals($result, can_send_from_real_email_address($fromuser, $touser, $alloweddomains));
$this->assertEquals($result, can_send_from_real_email_address($fromuser, $touser));
}
/**
@@ -3398,31 +3398,95 @@ class core_moodlelib_testcase extends advanced_testcase {
return [
// Test from email is in allowed domain.
// Test that from display is set to show no one.
['email' => '[email protected]', 'display' => core_user::MAILDISPLAY_HIDE,
'samecourse' => false, 'result' => false],
[
'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_HIDE,
'samecourse' => false,
'config' => "example.com\r\ntest.com",
'result' => false
],
// Test that from display is set to course members only (course member).
['email' => '[email protected]', 'display' => core_user::MAILDISPLAY_COURSE_MEMBERS_ONLY,
'samecourse' => true, 'result' => true],
[
'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_COURSE_MEMBERS_ONLY,
'samecourse' => true,
'config' => "example.com\r\ntest.com",
'result' => true
],
// Test that from display is set to course members only (Non course member).
['email' => '[email protected]', 'display' => core_user::MAILDISPLAY_COURSE_MEMBERS_ONLY,
'samecourse' => false, 'result' => false],
// Test that from display is set to show everyone.
['email' => '[email protected]', 'display' => core_user::MAILDISPLAY_EVERYONE,
'samecourse' => false, 'result' => true],
[
'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_COURSE_MEMBERS_ONLY,
'samecourse' => false,
'config' => "example.com\r\ntest.com",
'result' => false
],
// Test that from display is set to show everyone.
[
'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_EVERYONE,
'samecourse' => false,
'config' => "example.com\r\ntest.com",
'result' => true
],
// Test a few different config value formats for parsing correctness.
[
'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_EVERYONE,
'samecourse' => false,
'config' => "\n test.com\nexample.com \n",
'result' => true
],
[
'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_EVERYONE,
'samecourse' => false,
'config' => "\r\n example.com \r\n test.com \r\n",
'result' => true
],
// Test from email is not in allowed domain.
// Test that from display is set to show no one.
['email' => '[email protected]', 'display' => core_user::MAILDISPLAY_HIDE,
'samecourse' => false, 'result' => false],
// Test that from display is set to course members only (course member).
['email' => '[email protected]', 'display' => core_user::MAILDISPLAY_COURSE_MEMBERS_ONLY,
'samecourse' => true, 'result' => false],
// Test that from display is set to course members only (Non course member.
['email' => '[email protected]', 'display' => core_user::MAILDISPLAY_COURSE_MEMBERS_ONLY,
'samecourse' => false, 'result' => false],
// Test that from display is set to show everyone.
['email' => '[email protected]', 'display' => core_user::MAILDISPLAY_EVERYONE,
'samecourse' => false, 'result' => false],
[ 'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_HIDE,
'samecourse' => false,
'config' => "example.com\r\ntest.com",
'result' => false
],
// Test that from display is set to course members only (course member).
[ 'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_COURSE_MEMBERS_ONLY,
'samecourse' => true,
'config' => "example.com\r\ntest.com",
'result' => false
],
// Test that from display is set to course members only (Non course member.
[ 'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_COURSE_MEMBERS_ONLY,
'samecourse' => false,
'config' => "example.com\r\ntest.com",
'result' => false
],
// Test that from display is set to show everyone.
[ 'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_EVERYONE,
'samecourse' => false,
'config' => "example.com\r\ntest.com",
'result' => false
],
// Test a few erroneous config value and confirm failure.
[ 'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_EVERYONE,
'samecourse' => false,
'config' => "\r\n \r\n",
'result' => false
],
[ 'email' => '[email protected]',
'display' => core_user::MAILDISPLAY_EVERYONE,
'samecourse' => false,
'config' => " \n \n \n ",
'result' => false
],
];
}