Reject setting RFC non-compliant emission email addresses (#31154).

Patch by Mizuki ISHIKAWA.


git-svn-id: http://svn.redmine.org/redmine/trunk@18396 e93f8b46-1217-0410-a6f0-8f06a7374b81

2 files changed, 11 insertions, 1 deletions

diff --git a/app/models/email_address.rb b/app/models/email_address.rb
index 7f8eef5da..c3d8e8d41 100644
--- a/app/models/email_address.rb
+++ b/app/models/email_address.rb
@@ -20,6 +20,8 @@
 class EmailAddress < ActiveRecord::Base
   include Redmine::SafeAttributes
 
+  EMAIL_REGEXP = /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\z/i
+
   belongs_to :user
 
   after_update :destroy_tokens
@@ -30,7 +32,7 @@ class EmailAddress < ActiveRecord::Base
   after_destroy_commit :deliver_security_notification_destroy
 
   validates_presence_of :address
-  validates_format_of :address, :with => /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\z/i, :allow_blank => true
+  validates_format_of :address, :with => EMAIL_REGEXP, :allow_blank => true
   validates_length_of :address, :maximum => User::MAIL_LENGTH_LIMIT, :allow_nil => true
   validates_uniqueness_of :address, :case_sensitive => false,
     :if => Proc.new {|email| email.address_changed? && email.address.present?}
diff --git a/app/models/setting.rb b/app/models/setting.rb
index b18f8ed89..9eaaaec33 100644
--- a/app/models/setting.rb
+++ b/app/models/setting.rb
@@ -166,6 +166,14 @@ class Setting < ActiveRecord::Base
       end
     end
 
+    if settings.key?(:mail_from)
+      begin
+        mail_from = Mail::Address.new(settings[:mail_from])
+        raise unless mail_from.address =~ EmailAddress::EMAIL_REGEXP
+      rescue
+        messages << [:mail_from, l('activerecord.errors.messages.invalid')]
+      end
+    end
     messages
   end