Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-16504

ez email type validation allows invalid whitespace

    XMLWordPrintable

Details

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Medium Medium
    • None
    • 4.1.4
    • Misc
    • None
    • Operating System: Debian
      PHP Version: 5.2.6.dfsg.1-1+lenny8
      Database and version: 5.0.51a-24+lenny3

    Description

      ezemailtype.php uses a flawed method for validating email addresses. By removing whitespace first, then checking the validity of the email address, but not permanently removing the whitespace from the data, it is possible for an email address containing whitespace to end up stored, causing problems.

      Steps to reproduce

      1. Create class with email field as infocollector.
      2. Create object of this class.
      3. Create an override template for collectedinfomail/form.tpl, setting the email recipient from the collected info, e.g.:

      <code>

      {set-block scope=root variable=email_receiver}{$collection.attributes.0.data_text}{/set-block}<code>

      Result:

      Email is sent to the system default recipient (from site.ini.append.php).

      Expected result:

      Email should be sent to the collected address.

      On analysis, this turns out to be caused by the rogue whitespace.

      Suggested ways to fix:

      1. Strip the whitespace before storing the email address (best)
      2. Reject the email address as invalid
      3. Strip whitespace automatically when processing the set-block

      2 is technically correct, as an email address cannot contain a space, but I would argue 1 is more user friendly, as if the email is otherwise valid without the leading / trailing whitespace, the intent is clear. I don't like 3, as it seems like a hack; better to not store an invalid email address to start with.

      Workaround (easy, of course, but shouldn't be necessary):

      <code>{set-block scope=root variable=email_receiver}

      {$collection.attributes.0.data_text|trim()}

      {/set-block}

      <code>

      Attachments

        Activity

          People

            unknown unknown
            matthewc matthewc
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated: