Moodle

email_to_user does not check for an empty recipient address

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Minor Minor
  • Resolution: Fixed
  • Affects Version/s: 1.9.2
  • Fix Version/s: 1.9.5
  • Component/s: Libraries
  • Labels:
    None
  • Database:
    Any
  • Affected Branches:
    MOODLE_19_STABLE
  • Fixed Branches:
    MOODLE_19_STABLE

Description

Moodle will attempt to send email to a user even if their email address is null. This violates RFC821 and can generate a lot of error messages for administrators.

It seems a straightforward fix would be to change the first conditional in email_to_user() in lib/moodlelib.php from:

if (empty($user)) { return false; }

to:

if (empty($user) || empty($user->email)) { return false; } }

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Dan Poltawski added a comment -

Hi Jason, i'm interested how empty email addresses got into users profiles since I don't think any of forms allow this?

Show
Dan Poltawski added a comment - Hi Jason, i'm interested how empty email addresses got into users profiles since I don't think any of forms allow this?
Hide
Permalink
Jason Meinzer added a comment -

One way it can happen is when the LDAP registration module imports a user that lacks a mail attribute. Regardless of how it happens, there's no reason for the email_to_user() function to not do this basic sanity check since sending to null addresses will never have the desired effect and can generate a lot of annoying bounce messages.

Show
Jason Meinzer added a comment - One way it can happen is when the LDAP registration module imports a user that lacks a mail attribute. Regardless of how it happens, there's no reason for the email_to_user() function to not do this basic sanity check since sending to null addresses will never have the desired effect and can generate a lot of annoying bounce messages.
Hide
Permalink
Dan Poltawski added a comment -

Sorry for the delay on this, i've now commited this to CVS

Show
Dan Poltawski added a comment - Sorry for the delay on this, i've now commited this to CVS
Hide
Permalink
Petr Škoda (skodak) added a comment -

empty($user->email) would be enough, because PHP would not complain, but I agree this may be a bit more readable
thanks!

Show
Petr Škoda (skodak) added a comment - empty($user->email) would be enough, because PHP would not complain, but I agree this may be a bit more readable thanks!

People

Vote (0)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved:
Atlassian JIRA (v4.4.3#663-r165197) | Report a problem
Powered by a free Atlassian JIRA open source license for Moodle. Try JIRA - bug tracking software for your team.