Host Header Notification Email

[discobot]

Fix “From”, “Name”, and “Return-Path” headers for all WP notification emails since this is a long-standing WP security vulnerability.

---

Read-only archive: GitHub · Where software is built

Author: W.V. Pelyn T. Palarao

Vote count: 5

Status: Completed (1.5.0)

---

Comments

Agree, this functionality should be in core: Host Header Injection Fix – WordPress plugin | WordPress.org

(not my plugin/no affiliation; noted for reference)

~ posted by Daniel Hendricks

A quick read suggests that the root problem is that the web server doesn’t handle $_SERVER['SERVER_NAME'] correctly.

Is there more to it than that?

If not, I’d suggest a better solution is to flag this during install/upgrade so that the actual problem can be fixed, and point people towards a suitable plugin if they can’t/won’t fix the real problem.

~ posted by invisnet

[timkaye]

Fixed by WP in the following changeset: Changeset 48601 – WordPress Trac

[viktor]

There is an issue to fix/backport the changeset that fixes this: ClassicPress emails not coming from admin email · Issue #151 · ClassicPress/ClassicPress-v1 · GitHub

[omukiguy]

Backport done for this issue. WP-r48601: Ensure that a server hostname can be set by using network_home_url() by bahiirwa · Pull Request #1021 · ClassicPress/ClassicPress · GitHub

[viktor]

Thank you for backporting it. Status has been updated.

[alvarofranz]

@omukiguy

Backport done for this issue. WP-r48601: Ensure that a server hostname can be set by using network_home_url() by bahiirwa · Pull Request #1021 · ClassicPress/ClassicPress · GitHub

Just as a note, there you are replacing classicpress with wordpress:

(Line 1566)

[omukiguy]

Thanks for the catch. New commit made to fix this.

[viktor]

Planned for 1.5.0. Petition will be closed now.