english/components/com_mailto/controller.php
/**
	 * Send the message and display a notice
	 *
	 * @access public
	 * @since 1.5
	 */
Send the message and display a notice
@access public
@since 1.5
Send the message and display a notice @access public @since 1 . 5
function send()
	{
		JRequest::checkToken() or jexit(JText::_('JINVALID_TOKEN'));
		$app	= JFactory::getApplication();
		$session = JFactory::getSession();
		$db	= JFactory::getDbo();
		$timeout = $session->get('com_mailto.formtime', 0);
		if ($timeout == 0 || time() - $timeout < 20) {
			JError::raiseNotice(500, JText:: _ ('COM_MAILTO_EMAIL_NOT_SENT'));
			return $this->mailto();
		}
		jimport('joomla.mail.helper');
		$SiteName	= $app->getCfg('sitename');
		$MailFrom	= $app->getCfg('mailfrom');
		$FromName	= $app->getCfg('fromname');
		$link		= MailtoHelper::validateHash(JRequest::getCMD('link', '', 'post'));
		if (!$link || !JURI::isInternal($link)) {
			JError::raiseNotice(500, JText:: _ ('COM_MAILTO_EMAIL_NOT_SENT'));
			return $this->mailto();
		}
		$headers = array (	'Content-Type:',
							'MIME-Version:',
							'Content-Transfer-Encoding:',
							'bcc:',
							'cc:');
		$fields = array(
			'mailto',
			'sender',
			'from',
			'subject',
		);
		foreach ($fields as $field)
		{
			foreach ($headers as $header)
			{
				if (strpos($_POST[$field], $header) !== false)
				{
					JError::raiseError(403, '');
				}
			}
		}
		unset ($headers, $fields);
		$email				= JRequest::getString('mailto', '', 'post');
		$sender				= JRequest::getString('sender', '', 'post');
		$from				= JRequest::getString('from', '', 'post');
		$subject_default	= JText::sprintf('COM_MAILTO_SENT_BY', $sender);
		$subject			= JRequest::getString('subject', $subject_default, 'post');
		$error	= false;
		if (! $email  || ! JMailHelper::isEmailAddress($email))
		{
			$error	= JText::sprintf('COM_MAILTO_EMAIL_INVALID', $email);
			JError::raiseWarning(0, $error);
		}
		if (! $from || ! JMailHelper::isEmailAddress($from))
		{
			$error	= JText::sprintf('COM_MAILTO_EMAIL_INVALID', $from);
			JError::raiseWarning(0, $error);
		}
		if ($error)
		{
			return $this->mailto();
		}
		$msg	= JText :: _('COM_MAILTO_EMAIL_MSG');
		$body	= sprintf($msg, $SiteName, $sender, $from, $link);
		$subject = JMailHelper::cleanSubject($subject);
		$body	 = JMailHelper::cleanBody($body);
		$sender	 = JMailHelper::cleanAddress($sender);
		if (JUtility::sendMail($from, $sender, $email, $subject, $body) !== true)
		{
			JError::raiseNotice(500, JText:: _ ('COM_MAILTO_EMAIL_NOT_SENT'));
			return $this->mailto();
		}
		JRequest::setVar('view', 'sent');
		$this->display();
	}
function send ( ) { JRequest :: checkToken ( ) or jexit ( JText :: _ ( 'JINVALID_TOKEN' ) ) ; $ app = JFactory :: getApplication ( ) ; $ session = JFactory :: getSession ( ) ; $ db = JFactory :: getDbo ( ) ; $ timeout = $ session -> get ( 'com_mailto.formtime' , 0 ) ; if ( $ timeout == 0 || time ( ) - $ timeout < 20 ) { JError :: raiseNotice ( 500 , JText :: _ ( 'COM_MAILTO_EMAIL_NOT_SENT' ) ) ; return $ this -> mailto ( ) ; } jimport ( 'joomla.mail.helper' ) ; $ SiteName = $ app -> getCfg ( 'sitename' ) ; $ MailFrom = $ app -> getCfg ( 'mailfrom' ) ; $ FromName = $ app -> getCfg ( 'fromname' ) ; $ link = MailtoHelper :: validateHash ( JRequest :: getCMD ( 'link' , '' , 'post' ) ) ; if ( ! $ link || ! JURI :: isInternal ( $ link ) ) { JError :: raiseNotice ( 500 , JText :: _ ( 'COM_MAILTO_EMAIL_NOT_SENT' ) ) ; return $ this -> mailto ( ) ; } $ headers = array ( 'Content-Type:' , 'MIME-Version:' , 'Content-Transfer-Encoding:' , 'bcc:' , 'cc:' ) ; $ fields = array ( 'mailto' , 'sender' , 'from' , 'subject' , ) ; foreach ( $ fields as $ field ) { foreach ( $ headers as $ header ) { if ( strpos ( $ _POST [ $ field ] , $ header ) !== false ) { JError :: raiseError ( 403 , '' ) ; } } } unset ( $ headers , $ fields ) ; $ email = JRequest :: getString ( 'mailto' , '' , 'post' ) ; $ sender = JRequest :: getString ( 'sender' , '' , 'post' ) ; $ from = JRequest :: getString ( 'from' , '' , 'post' ) ; $ subject_default = JText :: sprintf ( 'COM_MAILTO_SENT_BY' , $ sender ) ; $ subject = JRequest :: getString ( 'subject' , $ subject_default , 'post' ) ; $ error = false ; if ( ! $ email || ! JMailHelper :: isEmailAddress ( $ email ) ) { $ error = JText :: sprintf ( 'COM_MAILTO_EMAIL_INVALID' , $ email ) ; JError :: raiseWarning ( 0 , $ error ) ; } if ( ! $ from || ! JMailHelper :: isEmailAddress ( $ from ) ) { $ error = JText :: sprintf ( 'COM_MAILTO_EMAIL_INVALID' , $ from ) ; JError :: raiseWarning ( 0 , $ error ) ; } if ( $ error ) { return $ this -> mailto ( ) ; } $ msg = JText :: _ ( 'COM_MAILTO_EMAIL_MSG' ) ; $ body = sprintf ( $ msg , $ SiteName , $ sender , $ from , $ link ) ; $ subject = JMailHelper :: cleanSubject ( $ subject ) ; $ body = JMailHelper :: cleanBody ( $ body ) ; $ sender = JMailHelper :: cleanAddress ( $ sender ) ; if ( JUtility :: sendMail ( $ from , $ sender , $ email , $ subject , $ body ) !== true ) { JError :: raiseNotice ( 500 , JText :: _ ( 'COM_MAILTO_EMAIL_NOT_SENT' ) ) ; return $ this -> mailto ( ) ; } JRequest :: setVar ( 'view' , 'sent' ) ; $ this -> display ( ) ; }
Send the message and display a notice
 @access public
 @since 1.5
Send the message and display a notice @access public @since 1 . 5
// Check for request forgeries // Verify that this is a local link //Non-local url... // An array of email headers we do not want to allow as input // An array of the input fields to scan for injected headers /*
		 * Here is the meat and potatoes of the header injection test.  We
		 * iterate over the array of form input and check for header strings.
		 * If we find one, send an unauthorized header and die.
		 */ /*
		 * Free up memory
		 */ // Check for a valid to address // Check for a valid from address // Build the message to send // Clean the email data // Send the email