105 lines
3.3 KiB
PHP
105 lines
3.3 KiB
PHP
<?php
|
|
// SMTP delivery via PHPMailer (already a project dependency).
|
|
|
|
require_once __DIR__ . '/../../../vendor/autoload.php';
|
|
|
|
use PHPMailer\PHPMailer\PHPMailer;
|
|
|
|
/** Treats the literal "null" from .env as "not set". */
|
|
function mail_env(string $key): string
|
|
{
|
|
$value = (string) (getenv($key) ?: '');
|
|
return ($value === 'null') ? '' : $value;
|
|
}
|
|
|
|
/**
|
|
* PHPMailer compares SMTPSecure with ===, so "SSL" from .env would silently fall
|
|
* back to an unencrypted socket and hang on an implicit-TLS port. Normalise, and
|
|
* infer the usual encryption from the port when MAIL_ENCRYPTION is not set.
|
|
*/
|
|
function mail_encryption(int $port): string
|
|
{
|
|
$enc = strtolower(mail_env('MAIL_ENCRYPTION'));
|
|
if ($enc === 'ssl' || $enc === 'tls') {
|
|
return $enc;
|
|
}
|
|
if ($enc !== '' && $enc !== 'none') {
|
|
error_log("mail: unknown MAIL_ENCRYPTION '{$enc}', falling back to the port default");
|
|
} elseif ($enc === 'none') {
|
|
return '';
|
|
}
|
|
|
|
return in_array($port, [465, 2465], true) ? 'ssl' : 'tls';
|
|
}
|
|
|
|
/**
|
|
* Never surfaces the SMTP error to the caller: it can leak host and credentials.
|
|
* The error log gets the connection details (minus the password) instead — without
|
|
* them a failure is indistinguishable from a wrong recipient address.
|
|
*/
|
|
function send_mail(string $to, string $subject, string $html): bool
|
|
{
|
|
if (!class_exists(PHPMailer::class)) {
|
|
error_log('mail failed: PHPMailer not installed');
|
|
return false;
|
|
}
|
|
|
|
$host = mail_env('MAIL_HOST') ?: 'localhost';
|
|
$port = (int) (mail_env('MAIL_PORT') ?: 587);
|
|
$user = mail_env('MAIL_USERNAME');
|
|
$enc = mail_encryption($port);
|
|
|
|
$mail = new PHPMailer(true);
|
|
try {
|
|
$mail->isSMTP();
|
|
$mail->Host = $host;
|
|
$mail->Port = $port;
|
|
$mail->CharSet = 'UTF-8';
|
|
// Default is 300s: an unreachable SMTP would otherwise stall registration.
|
|
$mail->Timeout = 10;
|
|
|
|
if ($user !== '') {
|
|
$mail->SMTPAuth = true;
|
|
$mail->Username = $user;
|
|
$mail->Password = mail_env('MAIL_PASSWORD');
|
|
}
|
|
if ($enc !== '') {
|
|
$mail->SMTPSecure = $enc;
|
|
}
|
|
|
|
$mail->setFrom(
|
|
mail_env('MAIL_FROM_ADDRESS') ?: 'noreply@casadoc.app',
|
|
mail_env('MAIL_FROM_NAME') ?: 'CasaDoc'
|
|
);
|
|
$mail->addAddress($to);
|
|
$mail->isHTML(true);
|
|
$mail->Subject = $subject;
|
|
$mail->Body = $html;
|
|
|
|
if ($mail->send()) {
|
|
return true;
|
|
}
|
|
error_log("mail failed to {$to} via {$enc}://{$user}@{$host}:{$port}: {$mail->ErrorInfo}");
|
|
|
|
return false;
|
|
} catch (Throwable $e) {
|
|
error_log("mail failed to {$to} via {$enc}://{$user}@{$host}:{$port}: " . $e->getMessage());
|
|
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function send_code_mail(string $to, string $code, bool $isReset = false): bool
|
|
{
|
|
$subject = $isReset ? 'CasaDoc password reset code' : 'CasaDoc verification code';
|
|
$intro = $isReset
|
|
? 'Use this code to reset your CasaDoc password:'
|
|
: 'Use this code to confirm your e-mail address:';
|
|
|
|
$html = '<p>' . $intro . '</p>'
|
|
. '<p style="font-size:28px;font-weight:bold;letter-spacing:4px">' . htmlspecialchars($code) . '</p>'
|
|
. '<p>The code expires in 15 minutes. If you did not request it, ignore this e-mail.</p>';
|
|
|
|
return send_mail($to, $subject, $html);
|
|
}
|