Re: [mlmmj] Subscribers management in php-admin

[Thomas Goirand <thomas@goirand.fr>]

On 03/01/2012 09:08 PM, Marc MAURICE wrote:
> +if (isset($_POST["tosubscribe"])) {
> +	
> +	foreach (preg_split('/\r\n|\n|\r/', $_POST["tosubscribe"]) as $line) {
> +		$email = trim($line);
> +		if ($email != "") {
> +			if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
> +				$cmd = "/usr/bin/mlmmj-sub -L '/var/spool/mlmmj/".escapeshellarg($list)."' -a '".escapeshellarg($email)."' 2>&1";
> +				exec($cmd, $out, $ret);
> +				if ($ret != 0) {
> +					$message.= "Subscribe error for $email <!--cmd=$cmd out=".implode($out)." ret=$ret--> <br/>";
> +				}
> +			} else {
> +				$message.= "Email address not valid: $email <br/>";

If $email isn't valid, then it's even more a reason not to display it
(eg: unless you want to shoot yourself in the foot with issues like
cross site scripting...).

Also, I'm not sure what you are attempting with "displaying" the output
of the subscribing command in a HTML comment. Why not displaying it for
real, using htmlspecialchars() (which by the way, you didn't use, which
is dangerous) and ln2br() in a <pre> tag?

Thomas