Security update for Core, with self-updated composer

[yaffs-website] / web / core / lib / Drupal / Core / Mail / MailManager.php

diff --git a/web/core/lib/Drupal/Core/Mail/MailManager.php b/web/core/lib/Drupal/Core/Mail/MailManager.php
index 6de2dd818c610c9c0ab7925c08463db585fe1204..348dceeb208d967356001561062e201ff26cb243 100644 (file)
--- a/web/core/lib/Drupal/Core/Mail/MailManager.php
+++ b/web/core/lib/Drupal/Core/Mail/MailManager.php
@@ -3,6 +3,7 @@
 namespace Drupal\Core\Mail;
 
 use Drupal\Component\Render\PlainTextOutput;
+use Drupal\Component\Utility\Unicode;
 use Drupal\Core\Logger\LoggerChannelFactoryInterface;
 use Drupal\Core\Plugin\DefaultPluginManager;
 use Drupal\Core\Cache\CacheBackendInterface;
@@ -169,7 +170,7 @@ class MailManager extends DefaultPluginManager implements MailManagerInterface {
     // attachments. Therefore we perform mailing inside its own render context,
     // to ensure it doesn't leak into the render context for the HTTP response
     // to the current request.
-    return $this->renderer->executeInRenderContext(new RenderContext(), function() use ($module, $key, $to, $langcode, $params, $reply, $send) {
+    return $this->renderer->executeInRenderContext(new RenderContext(), function () use ($module, $key, $to, $langcode, $params, $reply, $send) {
       return $this->doMail($module, $key, $to, $langcode, $params, $reply, $send);
     });
   }
@@ -248,7 +249,12 @@ class MailManager extends DefaultPluginManager implements MailManagerInterface {
     // Return-Path headers should have a domain authorized to use the
     // originating SMTP server.
     $headers['Sender'] = $headers['Return-Path'] = $site_mail;
-    $headers['From'] = $site_config->get('name') . ' <' . $site_mail . '>';
+    // Headers are usually encoded in the mail plugin that implements
+    // \Drupal\Core\Mail\MailInterface::mail(), for example,
+    // \Drupal\Core\Mail\Plugin\Mail\PhpMail::mail(). The site name must be
+    // encoded here to prevent mail plugins from encoding the email address,
+    // which would break the header.
+    $headers['From'] = Unicode::mimeHeaderEncode($site_config->get('name'), TRUE) . ' <' . $site_mail . '>';
     if ($reply) {
       $headers['Reply-to'] = $reply;
     }