[wp-trac] [WordPress Trac] #52822: PHPMailer change in WordPress 5.7 breaks working sites

[WordPress Trac]

#52822: PHPMailer change in WordPress 5.7 breaks working sites
-------------------------------------+---------------------
 Reporter:  tigertech                |       Owner:  (none)
     Type:  defect (bug)             |      Status:  new
 Priority:  high                     |   Milestone:  5.7.1
Component:  Mail                     |     Version:  5.7
 Severity:  normal                   |  Resolution:
 Keywords:  needs-patch 2nd-opinion  |     Focuses:
-------------------------------------+---------------------

Comment (by tigertech):

 Replying to [comment:9 galbaras]:
 > @SergeyBiryukov Perhaps, just as an interim measure, WordPress can check
 for `ini_get( 'sendmail_from' )` and, if set, pass it explicitly. This
 will simply restore things to the way they were before 5.7.

 That actually wouldn't fully restore it, because there's another common
 case being affected: even when there's nothing explicitly set in php.ini,
 the PHP mail() function without "-f" still may have generated a working
 value that's now being overridden.

 For example, if the Linux username is "user123" and the server's hostname
 is "server456.hostingcompany.com", then a message sent using PHP mail()
 with no "-f" option will default to an envelope sender of "user123@
 server456.hostingcompany.com", even if nothing is explicitly set in
 php.ini -- and many companies ensure that this default works by setting up
 SPF for "server456.hostingcompany.com" and setting up forwarding aliases
 to handle bounces that go to that address.

 So this isn't really php.ini specific, although that's an easy example
 showing the problem. The problem is more generally that wp_mail() via
 PHPMailer used to call PHP's mail() function with no "-f" parameter,
 letting PHP and the mail server figure out what the envelope sender
 address should be (whether that's the php.ini setting, or the default set
 in the mail server, or whatever).

 But now wp_mail() ends up always calling PHP mail() with a "-f" that's the
 same as the From address in the message, preventing PHP or the mail server
 from using whatever they would choose. To completely restore the original
 behavior, I think
 [https://github.com/PHPMailer/PHPMailer/commit/f9f5b8d21ed2b79fe2e660f2c0ae9c676e30210c
 the change in PHPMailer that now adds the "-f" by default] would have to
 be removed.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/52822#comment:10>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform