"cast" gets converted to "cast" to prevent the SQL function "CAST" from being injected. I found that the
sendmail() function in
pm_post_message.asp uses the
decodeString() function to decode the username and email addresses. However, in
email_messenger.asp, all the variables are sent to the
sendmail() function raw.
This is definitely a bug in 7.92 that seems to also exist at least as far back as 7.01. It seems to me that the best solution is to use the decodeString() function inside the sendmail() function itself. This more safely assumes the input is not sanitized.
In functions_send_mail.asp (in the forum/functions folder and the forum/admin/functions folder), immediately below the line "Function SendMail(...), add the following:
strRecipientEmailAddress = decodeString(strRecipientEmailAddress)
strRecipientName = decodeString(strRecipientName)
strFromEmailName = decodeString(strFromEmailName)
strFromEmailAddress = decodeString(strFromEmailAddress)
That should ensure that all the incoming data is restored before actually attempting to send mail.
Topic Options
Post Options
Thanks(0)
