Possible error in mail header of page-contact.php

[Nadine]

Nadine

April 17, 2016 at 2:56 pm

Hi!

1. I’ve based a custom form in my child theme on the code in the page-contact.php. I found something what I think can result in an error in edge cases:
$headers = __("From", "virtue").': '.$name.' <'.$emailTo.'>' . "rn" . 'Reply-To: ' . $email;
Here the “From” is translated (very different for each language), but in mail headers it should always be english “From”.

Anyways, wp_mail adds a “From” header anyway (which is [email protected] in my case). So this is not needed, especially there is “Reply-To” anyways for convenient and easy answering. I would propose to only use simply this instead:
$headers = "Reply-To: $email"

2. Besides this, I am not over all and totally sure if the parsing of the mail and comments user input is sufficient. The best resource on this is *Login to see link and here step 3 “Sanitize all the things”. … 5 min later … Ok, there is wp_filter_kses, so probably all same here 😉

Kind regards!