From af249cfc3f9ae1dd13be9b91e5e754e7c19bb81e Mon Sep 17 00:00:00 2001
From: jakubvrana <jakubvrana@7c3ca157-0c34-0410-bff1-cbf682f78f5c>
Date: Fri, 24 Jul 2009 10:55:01 +0000
Subject: [PATCH] Check for valid e-mail address

git-svn-id: https://adminer.svn.sourceforge.net/svnroot/adminer/trunk@900 7c3ca157-0c34-0410-bff1-cbf682f78f5c
---
 editor/include/adminer.inc.php | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/editor/include/adminer.inc.php b/editor/include/adminer.inc.php
index b5d51d70..d432cb09 100644
--- a/editor/include/adminer.inc.php
+++ b/editor/include/adminer.inc.php
@@ -136,11 +136,19 @@ function adminer_select_extra_process($where) {
 	if ($_POST["email"]) {
 		$sent = 0;
 		if ($_POST["all"] || $_POST["check"]) {
-			$where_check = "(" . implode(") OR (", array_map('where_check', (array) $_POST["check"])) . ")";
 			$field = idf_escape($_POST["email_field"]);
-			$result = $dbh->query("SELECT DISTINCT $field FROM " . idf_escape($_GET["select"]) . " WHERE $field IS NOT NULL AND $field != ''" . ($where ? " AND " . implode(" AND ", $where) : "") . ($_POST["all"] ? "" : " AND ($where_check)"));
+			$result = $dbh->query("SELECT DISTINCT $field FROM " . idf_escape($_GET["select"])
+				. " WHERE $field IS NOT NULL AND $field != ''"
+				. ($where ? " AND " . implode(" AND ", $where) : "")
+				. ($_POST["all"] ? "" : " AND ((" . implode(") OR (", array_map('where_check', (array) $_POST["check"])) . "))")
+			);
 			while ($row = $result->fetch_row()) {
-				$sent += mail($row[0], email_header($_POST["email_subject"]), $_POST["email_message"], "MIME-Version: 1.0\nContent-Type: text/plain; charset=utf-8\nContent-Transfer-Encoding: 8bit" . ($_POST["email_from"] ? "\nFrom: " . email_header($_POST["email_from"]) : ""));
+				if (is_email($row[0]) && mail($row[0], email_header($_POST["email_subject"]), $_POST["email_message"],
+					"MIME-Version: 1.0\nContent-Type: text/plain; charset=utf-8\nContent-Transfer-Encoding: 8bit"
+					. (is_email($_POST["email_from"]) ? "\nFrom: $_POST[email_from]" : "") //! should allow address with a name but simple application of email_header() adds the default server domain
+				)) {
+					$sent++;
+				}
 			}
 			$result->free();
 		}