Ticket #5887: mail.diff

File mail.diff, 1.9 KB (added by Carl Karsten <carl@…>, 8 years ago)

svn diff django/core/mail.py

  • django/core/mail.py

     
    6767class BadHeaderError(ValueError):
    6868    pass
    6969
    70 class SafeMIMEText(MIMEText):
    71     def __setitem__(self, name, val):
     70def forbid_multi_line_headers(name, val):
    7271        "Forbids multi-line headers, to prevent header injection."
    7372        if '\n' in val or '\r' in val:
    7473            raise BadHeaderError, "Header values can't contain newlines (got %r for header %r)" % (val, name)
     
    8483                val = ', '.join(result)
    8584            else:
    8685                val = Header(force_unicode(val), settings.DEFAULT_CHARSET)
     86    return (name, val)
     87
     88class SafeMIMEText(MIMEText):
     89    def __setitem__(self, name, val):
     90        name, val = forbid_multi_line_headers(name, val)
    8791        MIMEText.__setitem__(self, name, val)
    8892
    8993class SafeMIMEMultipart(MIMEMultipart):
    9094    def __setitem__(self, name, val):
    91         "Forbids multi-line headers, to prevent header injection."
    92         if '\n' in val or '\r' in val:
    93             raise BadHeaderError, "Header values can't contain newlines (got %r for header %r)" % (val, name)
    94         try:
    95             val = force_unicode(val).encode('ascii')
    96         except UnicodeEncodeError:
    97             if name.lower() in ('to', 'from', 'cc'):
    98                 result = []
    99                 for item in val.split(', '):
    100                     nm, addr = parseaddr(item)
    101                     nm = str(Header(nm, settings.DEFAULT_CHARSET))
    102                     result.append(formataddr((nm, str(addr))))
    103                 val = ', '.join(result)
    104             else:
    105                 val = Header(force_unicode(val), settings.DEFAULT_CHARSET)
     95        name, val = forbid_multi_line_headers(name, val)
    10696        MIMEMultipart.__setitem__(self, name, val)
    10797
    10898class SMTPConnection(object):
Back to Top