By spidersilk on

I recently upgraded a client's Drupal installation from 4.7.6 to 4.7.7 after seeing the security advisory, and now the client tells me that e-mails that come in via the contact form on the web site are now showing up as being from the site admin's address, rather than the address of the person e-mailing them, so they have no way of replying. The From, To and Reply-To addresses are all the site admin address, with the address of the person submitting the form showing up nowhere.

I checked the administer > contact settings to see if something was somehow set up differently there now, but couldn't see any changes there. I did find that the people's e-mail addresses were showing up in the log, so at least that means they can hopefully match them up with e-mails received by checking there, but they shouldn't have to do that.

Has anyone else encountered this problem? Is there some way of fixing it?

Thanks,

Lynna

⋅ Categories: Drupal 4.7.x

Comments

spidersilk’s picture

spidersilk commented

I checked the e-mail headers, and it's actually putting *two* From and Reply-to headers in there, one (of each) with the sender's address, and one with the site admin's address.

I also checked the code of contact.module itself, and cannot for the life of me figure out how it is putting in two of them... So I'm really not that much further ahead than before, I guess.

Any help would be much appreciated!

Lynna

markj’s picture

markj commented

I am experiencing the exact same problem (move from 4.6.7 to 4.7.7, using the stock contact module). By revealing all the headers in my email client, I see that there are two From: headers, the first one is the Drupal admin's address and the second one, which is the very last field in the header, is the sender's address. I checked the RFC for emails (http://www.faqs.org/rfcs/rfc822.html) and it is not clear to me (see section 4.4.1) if more than one From: is allowed. However, it there is no good reason to have two, there probably only should be one, i.e., the sender's address, not the Drupal admin's address.

Mark

Matthew Davidson’s picture

Matthew Davidson commented

This is a result of a bad solution to a pretty minor bug. It's since been reversed in 4.7.x-dev.

If you edit your user.module file, replacing the user_mail function with the function from 4.7.6, it'll work. The next version of 4.7.x, if there is one, won't have this bug.

spidersilk’s picture

spidersilk commented

I actually ended up upgrading the site to Drupal 5, since I couldn't find any other fix at the time. Would have probably done that eventually anyway -- the contact form problem just provided the motivation for the client to say yes to it now.