[wp-hackers] Bug in wp_mail

[Ron Guerin]

Since I really don't need to be getting the bounces and whatnot for
everyone running WordPress on my server,  I'm trying to track down why
the Return-Path: in mail sent by WordPress is set to my web server's
email address instead of something from WordPress, or even a Return-Path
I forced by setting "php_value sendmail_from".  I discovered wp_mail in
pluggable.php appears to not ever actually set the sender, which assures
that an undesirable default gets used instead of something actually
configured in WP (like the admin's address, or even
wordpress at domaininquestion.com)

I think something else must be wrong in addition, since WP is
overriding  PHP's explicit sendmail_from , which it seems to me should
be a workaround for a mere failure to set the sender.

I have patched the bug locally by adding (wp-includes/pluggable.php)

        // Plugin authors can override the potentially troublesome default
        $phpmailer->From = apply_filters( 'wp_mail_from', $from_email );
        $phpmailer->FromName = apply_filters( 'wp_mail_from_name',
$from_name );
+       $phpmailer->Sender = $from_email;

... but this will be overwritten at next upgrade, and I'm guessing the
problem really needs something more than that as a proper fix.

- Ron