NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement CSRF protection for user invitation and management actions; add QR code generation script; secure internal includes directory with .htaccess

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-11 14:46:08 +02:00
parent 55618ffaed
commit cf0ceeca82
18 changed files with 413 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/mailer.php
+14 -3
View File
@@ -35,15 +35,26 @@ class FocizMailer {
$logs[] = date('H:i:s') . ' ' . $msg;
};
// Saniteer e-mailadressen en headers tegen CRLF en SMTP command injection
$toEmail = str_replace(["\r", "\n", "\0"], '', trim($toEmail));
$toName = str_replace(["\r", "\n", "\0"], '', trim($toName));
$subject = str_replace(["\r", "\n", "\0"], '', trim($subject));
if (!filter_var($toEmail, FILTER_VALIDATE_EMAIL)) {
$err = "Ongeldig e-mailadres voor verzending: {$toEmail}";
$log("FOUT: {$err}");
return ['success' => false, 'error' => $err, 'logs' => $logs];
}
// 1. Configuratieparameters ophalen
$host = $options['host'] ?? (defined('SMTP_HOST') ? SMTP_HOST : 'mail.fociz.nl');
$port = (int)($options['port'] ?? (defined('SMTP_PORT') ? SMTP_PORT : 587));
$username = $options['username'] ?? (defined('SMTP_USER') ? SMTP_USER : 'info@fociz.nl');
$password = $options['password'] ?? (defined('SMTP_PASS') ? SMTP_PASS : '');
$secure = strtolower($options['secure'] ?? (defined('SMTP_SECURE') ? SMTP_SECURE : 'tls'));
$fromEmail = $options['from_email'] ?? (defined('SMTP_FROM_EMAIL') ? SMTP_FROM_EMAIL : 'no-reply@fociz.nl');
$fromName = $options['from_name'] ?? (defined('SMTP_FROM_NAME') ? SMTP_FROM_NAME : 'Fociz');
$replyTo = $options['reply_to'] ?? (defined('SMTP_REPLY_TO') ? SMTP_REPLY_TO : 'info@fociz.nl');
$fromEmail = str_replace(["\r", "\n", "\0"], '', trim($options['from_email'] ?? (defined('SMTP_FROM_EMAIL') ? SMTP_FROM_EMAIL : 'no-reply@fociz.nl')));
$fromName = str_replace(["\r", "\n", "\0"], '', trim($options['from_name'] ?? (defined('SMTP_FROM_NAME') ? SMTP_FROM_NAME : 'Fociz')));
$replyTo = str_replace(["\r", "\n", "\0"], '', trim($options['reply_to'] ?? (defined('SMTP_REPLY_TO') ? SMTP_REPLY_TO : 'info@fociz.nl')));
$timeout = (int)($options['timeout'] ?? 15);
// Technische afzender voor de SMTP envelope (moet doorgaans overeenkomen met het geauthenticeerde account)