Skip to content

Email copy's "To" -field is sanitized with sanitize_email() in save_post -hook #145

@ironland

Description

@ironland

Shouldn't there be a chance to also use dynamic / placeholder values in the first field of the email copy that defines the recipient of the email? Now it gets sanitized as an email address. The affected code is in class-wplf-form.php on lines 789 - 813.

    // save email copy
    if ( isset( $_POST['wplf_email_copy_to'] ) ) {
      $email_field = $_POST['wplf_email_copy_to'];
      $to = '';

      if ( strpos( $email_field, ',' ) > 0 ) {
        // Intentional. Makes no sense if the first character is a comma, so pass it along as a single address.
        // sanitize_email() should take care of the rest.
        $email_array = explode( ',', $email_field );
        foreach ( $email_array as $email ) {
          $email = trim( $email );
          $email = sanitize_email( $email ) . ', ';
          $to .= $email;
        }
        $to = rtrim( $to, ', ' );
      } else {
        $to = sanitize_email( $email_field );
      }

      if ( ! empty( $to ) ) {
        update_post_meta( $post_id, '_wplf_email_copy_to', $to );
      } else {
        delete_post_meta( $post_id, '_wplf_email_copy_to' );
      }
    }

Even though the code above is in the plugin, in the file wplf-form-actions.php on line 62 there's a line of code that runs the replacing method to the "to" -field as well with no results, because the field is sanitized on post save. The affected code:

    // maybe replace template tags with real content
    $to = wplf_email_copy_replace_tags( $to, $form, $submission_id );

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions