Contact Form: adjust wording for filter description. (#20979)

* Contact Form: adjust wording for filter description. One can use this filter to automatically set up cc or bcc for all contact forms on the site, based on data submitted by site visitors. See the description in #20912 for an example. Let's make it clear that by doing so, you're allowing visitors to send emails to any email address they want. * Update projects/plugins/jetpack/modules/contact-form/grunion-contact-form.php Co-authored-by: Brad Jorsch <[email protected]> Co-authored-by: Brad Jorsch <[email protected]>
Automattic · Sep 8, 2021 · 84ac01a · 84ac01a
1 parent 8f30c2c
commit 84ac01a
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/projects/plugins/jetpack/changelog/update-form-filter-note-caution b/projects/plugins/jetpack/changelog/update-form-filter-note-caution
@@ -0,0 +1,5 @@
+Significance: patch
+Type: other
+Comment: Form: adjust wording for filter description.
+
+
diff --git a/projects/plugins/jetpack/modules/contact-form/grunion-contact-form.php b/projects/plugins/jetpack/modules/contact-form/grunion-contact-form.php
@@ -2889,6 +2889,12 @@ function process_submission() {
 		/**
 		 * Allow customizing the email headers.
 		 *
+		 * Warning: DO NOT add headers or header data from the form submission without proper
+		 * escaping and validation, or you're liable to allow abusers to use your site to send spam.
+		 *
+		 * Especially DO NOT take email addresses from the form data to add as CC or BCC headers
+		 * without strictly validating each address against a list of allowed addresses.
+		 *
 		 * @module contact-form
 		 *
 		 * @since 10.2.0