Page 1 of 1

Email spoofing

Posted: Mon Jun 06, 2022 3:47 pm
by Pierre_P
Hello

Regarding servers spoofing prevention that my host decided to implement.
Basically if a customer uses the contact_us page, the store owner cannot reply to that email
How to add additional headers? as i understand : Reply-to: [your-name] <[your-email]>

It seems this will become the norm..

Re: Email spoofing

Posted: Tue Jun 07, 2022 5:21 am
by Pierre_P
If this comes up later for anyone else

I have done this on email.php from line 393


$sender_headers = ['From: ' . $from, 'Reply-to: ' . $from];
}

$headers = array_merge($this->headers, $sender_headers, $this->normalize_headers($headers));

return mail($to, $this->ensure_encoding($subject. ' || ' . $from_addr), $this->output, implode($this->lf, $headers), "-f$from_addr");
}

Re: Email spoofing

Posted: Tue Jun 07, 2022 12:21 pm
by ecartz
If you looked four lines higher, you could see that all that you need to do is to set an EMAIL_FROM to get a Reply-to header without any code changes.

https://github.com/CE-PhoenixCart/Phoen ... y-to-email

Re: Email spoofing

Posted: Tue Jun 07, 2022 3:59 pm
by Pierre_P
Thanks @ecartz

That worked as well
I have an older version also that i had to update.
Btw, you specify only root@localhost as email address
is there a way to show Shop Admin instead of root@localhost in the FROM address

So when entering Email Options - I tried like: Shop Admin <shop@mystore>

Re: Email spoofing

Posted: Tue Jun 07, 2022 4:26 pm
by burt
Pierre_P wrote: Tue Jun 07, 2022 3:59 pm Thanks @ecartz

That worked as well
I have an older version also that i had to update.
Btw, you specify only root@localhost as email address
is there a way to show Shop Admin instead of root@localhost in the FROM address

So when entering Email Options - I tried like: Shop Admin <shop@mystore>
Change the email address in your shop admin;

Admin > Configuration > My Store > Email address

Re: Email spoofing

Posted: Tue Jun 07, 2022 4:42 pm
by ecartz
Because of the way that it is written, it has to be a simple email address. It does not have to be root@localhost -- you@example.com would be fine.

If you absolutely must have the more complicated form, try changing line 390 to

Code: Select all

        $sender_headers = ['From: ' . $this->format_address(EMAIL_FROM, STORE_OWNER), 'Reply-to: ' . $from];
Leave the other lines the same.

This would be better than your original change in that if the code was reverted, it would still be functional. The only difference is the display.