From d390bee0bc60822a184ac2b314305ab7dcde07f8 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Sat, 20 Jan 2024 21:16:28 -0500 Subject: [PATCH] Update/Fix Mail Functions in cron.php - sanitize POST vars instead the whole mail subject and body which prevents having a mixed of confusing redundant escaped and unescaped vars --- cron.php | 37 ++++++++++++++++--------------------- 1 file changed, 16 insertions(+), 21 deletions(-) diff --git a/cron.php b/cron.php index 2a032d66..b08c3688 100644 --- a/cron.php +++ b/cron.php @@ -14,7 +14,7 @@ $row = mysqli_fetch_array($sql_companies); // Company Details $company_name = sanitizeInput($row['company_name']); -$company_phone = formatPhoneNumber($row['company_phone']); +$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'])); $company_email = sanitizeInput($row['company_email']); $company_website = sanitizeInput($row['company_website']); $company_city = sanitizeInput($row['company_city']); @@ -39,8 +39,8 @@ $config_smtp_username = $row['config_smtp_username']; $config_smtp_password = $row['config_smtp_password']; $config_smtp_port = intval($row['config_smtp_port']); $config_smtp_encryption = $row['config_smtp_encryption']; -$config_mail_from_email = $row['config_mail_from_email']; -$config_mail_from_name = $row['config_mail_from_name']; +$config_mail_from_email = sanitizeInput($row['config_mail_from_email']); +$config_mail_from_name = sanitizeInput($row['config_mail_from_name']); $config_recurring_auto_send_invoice = intval($row['config_recurring_auto_send_invoice']); // Tickets @@ -280,25 +280,22 @@ if (mysqli_num_rows($sql_scheduled_tickets) > 0) { $contact_name = sanitizeInput($row['contact_name']); $contact_email = sanitizeInput($row['contact_email']); - $client_name = sanitizeInput($row['client_name']); $contact_name = sanitizeInput($row['contact_name']); $contact_email = sanitizeInput($row['contact_email']); $ticket_prefix = sanitizeInput($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); $ticket_priority = sanitizeInput($row['ticket_priority']); - - // Not Sanitized Vars because they are already sanitized in subject and body wrapper - $ticket_subject = $row['ticket_subject']; - $ticket_details = $row['ticket_details']; // Output on settings_mail_queue.php is sanitized through HTML Purifier + $ticket_subject = mysqli_real_escape_string($mysqli, $row['ticket_subject']); + $ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']); $data = []; // Notify client by email their ticket has been raised, if general notifications are turned on & there is a valid contact email if (!empty($config_smtp_host) && $config_ticket_client_general_notifications == 1 && filter_var($contact_email, FILTER_VALIDATE_EMAIL)) { - $email_subject = mysqli_real_escape_string($mysqli, "Ticket created - [$ticket_prefix$ticket_number] - $ticket_subject (scheduled)"); - $email_body = mysqli_real_escape_string($mysqli, "##- Please type your reply above this line -##

Hello, $contact_name

A ticket regarding \"$ticket_subject\" has been automatically created for you.

--------------------------------
$ticket_details--------------------------------

Ticket: $ticket_prefix$ticket_number
Subject: $ticket_subject
Status: Open
Portal: https://$config_base_url/portal/ticket.php?id=$id

~
$company_name
Support Department
$config_ticket_from_email
$company_phone"); + $email_subject = "Ticket created - [$ticket_prefix$ticket_number] - $ticket_subject (scheduled)"; + $email_body = "##- Please type your reply above this line -##

Hello $contact_name,

A ticket regarding \"$ticket_subject\" has been automatically created for you.

--------------------------------
$ticket_details--------------------------------

Ticket: $ticket_prefix$ticket_number
Subject: $ticket_subject
Status: Open
Portal: https://$config_base_url/portal/ticket.php?id=$id

--
$company_name - Support
$config_ticket_from_email
$company_phone"; $email = [ 'from' => $config_ticket_from_email, @@ -316,8 +313,8 @@ if (mysqli_num_rows($sql_scheduled_tickets) > 0) { // Notify agent's via the DL address of the new ticket, if it's populated with a valid email if (filter_var($config_ticket_new_ticket_notification_email, FILTER_VALIDATE_EMAIL)) { - $email_subject = mysqli_real_escape_string($mysqli, "ITFlow - New Scheduled Ticket - $client_name: $ticket_subject"); - $email_body = mysqli_real_escape_string($mysqli, "Hello,

This is a notification that a new scheduled ticket has been raised in ITFlow.
Ticket: $ticket_prefix$ticket_number
Client: $client_name
Priority: $priority
Link: https://$config_base_url/ticket.php?ticket_id=$id

--------------------------------

$ticket_subject
$ticket_details"); + $email_subject = "ITFlow - New Scheduled Ticket - $client_name: $ticket_subject"; + $email_body = "Hello,

This is a notification that a new scheduled ticket has been raised in ITFlow.
Ticket: $ticket_prefix$ticket_number
Client: $client_name
Priority: $priority
Link: https://$config_base_url/ticket.php?ticket_id=$id

--------------------------------

$ticket_subject
$ticket_details"; $email = [ 'from' => $config_ticket_from_email, @@ -420,8 +417,8 @@ if ($config_ticket_autoclose == 1) { $ticket_reply_row = mysqli_fetch_array($sql_ticket_reply); $ticket_reply = $ticket_reply_row['ticket_reply']; - $subject = mysqli_real_escape_string($mysqli, "Ticket pending closure - [$ticket_prefix$ticket_number] - $ticket_subject"); - $body = mysqli_real_escape_string($mysqli, "##- Please type your reply above this line -##

Hello, $contact_name

This is an automatic friendly reminder that your ticket regarding $ticket_subject will be closed, unless you respond.

--------------------------------
$ticket_reply--------------------------------

If your issue is resolved, you can ignore this email - the ticket will automatically close. If you need further assistance, please respond to this email.

Ticket: $ticket_prefix$ticket_number
Subject: $ticket_subject
Status: $ticket_status
Portal: https://$config_base_url/portal/ticket.php?id=$ticket_id

~
$company_name
Support Department
$config_ticket_from_email
$company_phone"); + $subject = "Ticket pending closure - [$ticket_prefix$ticket_number] - $ticket_subject"; + $body = "##- Please type your reply above this line -##

Hello, $contact_name

This is an automatic friendly reminder that your ticket regarding $ticket_subject will be closed, unless you respond.

--------------------------------
$ticket_reply--------------------------------

If your issue is resolved, you can ignore this email - the ticket will automatically close. If you need further assistance, please respond to this email.

Ticket: $ticket_prefix$ticket_number
Subject: $ticket_subject
Status: $ticket_status
Portal: https://$config_base_url/portal/ticket.php?id=$ticket_id

--
$company_name - Support
$config_ticket_from_email
$company_phone"; $data = [ [ @@ -501,10 +498,10 @@ if ($config_send_invoice_reminders == 1) { mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Invoice Overdue', notification = 'Invoice $invoice_prefix$invoice_number for $client_name in the amount of $invoice_amount is overdue by $day days', notification_action = 'invoice.php?invoice_id=$invoice_id', notification_client_id = $client_id, notification_entity_id = $invoice_id"); - $subject = mysqli_real_escape_string($mysqli, "Overdue Invoice $invoice_prefix$invoice_number"); - $body = mysqli_real_escape_string($mysqli, "Hello $contact_name,

Our records indicate that we have not yet received payment for the invoice $invoice_prefix$invoice_number. We kindly request that you submit your payment as soon as possible. If you have any questions or concerns, please do not hesitate to contact us at $company_phone. + $subject = "Overdue Invoice $invoice_prefix$invoice_number"; + $body = "Hello $contact_name,

Our records indicate that we have not yet received payment for the invoice $invoice_prefix$invoice_number. We kindly request that you submit your payment as soon as possible. If you have any questions or concerns, please do not hesitate to contact us at $company_phone.

- Kindly review the invoice details mentioned below.

Invoice: $invoice_prefix$invoice_number
Issue Date: $invoice_date
Total: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "
Due Date: $invoice_due


To view your invoice click here


~
$company_name
Billing Department
$config_invoice_from_email
$company_phone"); + Kindly review the invoice details mentioned below.

Invoice: $invoice_prefix$invoice_number
Issue Date: $invoice_date
Total: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "
Due Date: $invoice_due


To view your invoice click here


--
$company_name - Billing
$config_invoice_from_email
$company_phone"; $mail = addToMailQueue($mysqli, [ [ @@ -619,8 +616,8 @@ while ($row = mysqli_fetch_array($sql_recurring)) { $contact_name = sanitizeInput($row['contact_name']); $contact_email = sanitizeInput($row['contact_email']); - $subject = mysqli_real_escape_string($mysqli, "Invoice $invoice_prefix$invoice_number"); - $body = mysqli_real_escape_string($mysqli, "Hello $contact_name,

Kindly review the invoice details mentioned below.

Invoice: $invoice_prefix$invoice_number
Issue Date: $invoice_date
Total: " . numfmt_format_currency($currency_format, $invoice_amount, $recurring_currency_code) . "
Due Date: $invoice_due


To view your invoice click here


~
$company_name
Billing Department
$config_invoice_from_email
$company_phone"); + $subject = "Invoice $invoice_prefix$invoice_number"; + $body = "Hello $contact_name,

Kindly review the invoice details mentioned below.

Invoice: $invoice_prefix$invoice_number
Issue Date: $invoice_date
Total: " . numfmt_format_currency($currency_format, $invoice_amount, $recurring_currency_code) . "
Due Date: $invoice_due


To view your invoice click here


--
$company_name - Billing
$config_invoice_from_email
$company_phone"; $mail = addToMailQueue($mysqli, [ [ @@ -966,8 +963,6 @@ if ($config_telemetry > 0 OR $config_telemetry = 2) { mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Cron', log_action = 'Telemetry', log_description = 'Cron sent telemetry results to ITFlow Developers'"); } - - /* * ############################################################################################################### * FINISH UP