Skip to content

Mail: Fix multiline From header parsing in wp_mail() #9300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SainathPoojary wants to merge 5 commits into
base: trunk
Choose a base branch
from
Open

Mail: Fix multiline From header parsing in wp_mail() #9300

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f0cea67
Mail: Fix multiline From header parsing in wp_mail()
SainathPoojary Jul 22, 2025
953ba02
Mail: Improve comment for header continuation handling in wp_mail()
SainathPoojary Jul 28, 2025
1868312
Mail: Enhance wp_mail() header parsing to handle whitespace and MIME …
SainathPoojary Aug 5, 2025
234b069
Mail: Fix multiline From header parsing in wp_mail()
SainathPoojary Sep 9, 2025
a9c8e97
Mail: Remove unnecessary MIME decoding for From header in wp_mail()
SainathPoojary Sep 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 14 additions & 3 deletions src/wp-includes/pluggable.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,10 +294,21 @@ function wp_mail( $to, $subject, $message, $headers = '', $attachments = array()
} else {
if ( ! is_array( $headers ) ) {
/*
* Explode the headers out, so this function can take
* both string headers and an array of headers.
* Process headers and handle folding in a single pass.
* Lines starting with whitespace (space or tab) are continuations of the previous line.
*/
$tempheaders = explode( "\n", str_replace( "\r\n", "\n", $headers ) );
$tempheaders = array();
$normalized_headers = str_replace( "\r\n", "\n", $headers );

foreach ( explode( "\n", $normalized_headers ) as $header_line ) {
if ( ! empty( $tempheaders ) && isset( $header_line[0] ) && ( ' ' === $header_line[0] || "\t" === $header_line[0] ) ) {
// Continuation line - append to previous header.
$last_index = count( $tempheaders ) - 1;
$tempheaders[ $last_index ] .= "\n" . $header_line;
} else {
$tempheaders[] = $header_line;
}
}
} else {
$tempheaders = $headers;
}
Expand Down
20 changes: 20 additions & 0 deletions tests/phpunit/tests/pluggable/wpMail.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -625,4 +625,24 @@ public function test_wp_mail_string_embeds() {
$this->assertStringContainsString( 'cid:' . $key, $mailer->get_sent()->body, 'The cid ' . $key . ' is not referenced in the mail body.' );
}
}

/**
* Tests that wp_mail() correctly handles multiline From headers by unfolding them.
*
* @ticket 28473
*/
public function test_wp_mail_multiline_header() {
$headers = 'From: =?UTF-8?B?0YLQtdGB0YIg0YLQtdGB0YIg0YLQtdGB0YIg0YLQtdGB0YIg0YLQtdGB0YIg?=';
$headers .= "\n =?UTF-8?B?0YLQtdGB0YIg0YLQtdGB0YI=?= <[email protected]>";
wp_mail( '[email protected]', 'subject', 'message', $headers );

$mailer = tests_retrieve_phpmailer_instance();
// phpcs:disable WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase
$this->assertSame( '[email protected]', $mailer->From );
$this->assertSame(
'=?UTF-8?B?0YLQtdGB0YIg0YLQtdGB0YIg0YLQtdGB0YIg0YLQtdGB0YIg0YLQtdGB0YIg?= =?UTF-8?B?0YLQtdGB0YIg0YLQtdGB0YI=?=',
$mailer->FromName
);
// phpcs:enable
}
}
Loading