Skip to content

FIX #39938 Restore email sender field references - #39940

Merged
eldy merged 1 commit into
Dolibarr:24.0from
nathanpixodeo:fix/39938-email-template-sender
Aug 31, 2026
Merged

eldy merged 1 commit into
Dolibarr:24.0from
nathanpixodeo:fix/39938-email-template-sender

Conversation

@nathanpixodeo

Copy link
Copy Markdown
Contributor

Summary

  • restore the literal email_from column when loading a template sender
  • restore the email_from event context key and object property after sending
  • keep the intended local $email_from variable rename from Qual: Fix 'SqlInjection' notices #39213

Root cause

The variable rename in #39213 accidentally converted literal SQL/object field names into dynamic references. With an initially empty sender value, the template query became SELECT rowid, FROM ... and failed before fetch_object().

Verification

  • php -l htdocs/core/actions_sendmails.inc.php
  • git diff --check
  • focused SQLite proof: the previous generated query fails; the corrected query returns the template email_from
  • source scan confirms all four corrupted dynamic references are gone

Fixes #39938

Signed-off-by: Nathan Pixodeo <nathan@pixodeo.net>
@eldy
eldy merged commit 043958a into Dolibarr:24.0 Aug 31, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants