diff --git a/public/userportal/api/_mail.php b/public/userportal/api/_mail.php index bead994..a268f08 100644 --- a/public/userportal/api/_mail.php +++ b/public/userportal/api/_mail.php @@ -18,29 +18,44 @@ function mail_env(string $key, string $default = ''): string return ($value === '' || $value === 'null') ? $default : $value; } +function mail_encryption(int $port): string +{ + $enc = strtolower(mail_env('MAIL_ENCRYPTION')); + if ($enc === 'ssl' || $enc === 'tls') { + return $enc; + } + if ($enc === 'none') { + return ''; + } + + return in_array($port, [465, 2465], true) ? 'ssl' : 'tls'; +} + /** Never surfaces the SMTP error to the caller: it can leak host and credentials. */ function send_mail(string $to, string $subject, string $html): bool { + $port = (int) mail_env('MAIL_PORT', '587'); + $enc = mail_encryption($port); $where = sprintf( '%s@%s:%s (%s)', mail_env('MAIL_USERNAME'), mail_env('MAIL_HOST', 'localhost'), - mail_env('MAIL_PORT', '587'), - mail_env('MAIL_ENCRYPTION', 'none') + $port, + $enc ?: 'none' ); $mail = new PHPMailer(true); try { $mail->isSMTP(); $mail->Host = mail_env('MAIL_HOST', 'localhost'); - $mail->Port = (int) mail_env('MAIL_PORT', '587'); + $mail->Port = $port; $mail->SMTPAuth = true; $mail->Username = mail_env('MAIL_USERNAME'); $mail->Password = mail_env('MAIL_PASSWORD'); - $mail->SMTPSecure = mail_env('MAIL_ENCRYPTION', PHPMailer::ENCRYPTION_STARTTLS); + $mail->SMTPSecure = $enc; $mail->CharSet = 'UTF-8'; - // Default is 300s: an unreachable SMTP would otherwise stall registration. - $mail->Timeout = 10; + $mail->Timeout = 10; + $mail->getSMTPInstance()->Timelimit = 15; $from = mail_env('MAIL_FROM_ADDRESS', 'noreply@casadoc.app'); // Without this the Message-ID is generated as <...@localhost>, which some