Differential D5661

Avoid including the name in the signup verification email as potential exploit path
ClosedPublic
Actions

Authored by mollekopf on Oct 6 2025, 8:47 AM.

Project Tags

None

Referenced Files

None

Subscribers

machniak

Details

Reviewers

machniak

Group Reviewers

Restricted Project

Commits

rK0c0238dc7be2: Avoid including the name in the signup verification email as potential exploit…

Summary

It can be used to send a string in the form of the name to an email
address.

Diff Detail

Repository

rK kolab

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

mollekopf requested review of this revision.Oct 6 2025, 8:47 AM

mollekopf created this revision.

Harbormaster completed remote builds in B55632: Diff 16227.Oct 6 2025, 8:47 AM

not tested yet

machniak requested changes to this revision.Oct 6 2025, 8:55 AM

machniak subscribed.

machniak added inline comments.

src/tests/Unit/Mail/SignupVerificationTest.php
38	I think strpos() will return 0 here. I suppose we should just use assertStringContainsString().

This revision now requires changes to proceed.Oct 6 2025, 8:55 AM

use assertStringContainsString, executed the test

Harbormaster completed remote builds in B55638: Diff 16230.Oct 6 2025, 12:03 PM

machniak accepted this revision.Oct 6 2025, 12:08 PM

This revision is now accepted and ready to land.Oct 6 2025, 12:08 PM

Closed by commit rK0c0238dc7be2: Avoid including the name in the signup verification email as potential exploit…. · Explain WhyOct 6 2025, 12:08 PM

This revision was automatically updated to reflect the committed changes.

mollekopf added a commit: rK0c0238dc7be2: Avoid including the name in the signup verification email as potential exploit….

Revision Contents
Changeset List

Path

Size

src/

app/

Http/

Controllers/

API/

SignupController.php

line

Mail/

SignupVerification.php

lines

resources/

lang/

en/

mail.php

line

views/

emails/

html/

signup_verification.blade.php

lines

plain/

signup_verification.blade.php

lines

tests/

Unit/

Mail/

SignupVerificationTest.php

lines

Diff 16233

View Options

src/app/Http/Controllers/API/SignupController.php

View Options

src/app/Mail/SignupVerification.php

View Options

src/resources/lang/en/mail.php

View Options

src/resources/views/emails/html/signup_verification.blade.php

View Options

src/resources/views/emails/plain/signup_verification.blade.php

View Options

src/tests/Unit/Mail/SignupVerificationTest.php

Avoid including the name in the signup verification email as potential exploit pathClosedPublicActions

Details

Diff Detail

Event Timeline

Revision ContentsChangeset List

Diff 16233

src/app/Http/Controllers/API/SignupController.php

src/app/Mail/SignupVerification.php

src/resources/lang/en/mail.php

src/resources/views/emails/html/signup_verification.blade.php

src/resources/views/emails/plain/signup_verification.blade.php

src/tests/Unit/Mail/SignupVerificationTest.php

Avoid including the name in the signup verification email as potential exploit path
ClosedPublic
Actions

Revision Contents
Changeset List