Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Added more explanation to docs/email.txt 'Preventing header injection…

…' section.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@1923 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit b125cafbfc715f808b8af6125a1c1dddc7079963 1 parent 51a699d
@adrianholovaty adrianholovaty authored
Showing with 8 additions and 4 deletions.
  1. +8 −4 docs/email.txt
View
12 docs/email.txt
@@ -124,10 +124,14 @@ scripts generate.
The Django e-mail functions outlined above all protect against header injection
by forbidding newlines in header values. If any ``subject``, ``from_email`` or
-``recipient_list`` contains a newline, the e-mail function (e.g.
-``send_mail()``) will raise ``django.core.mail.BadHeaderError`` (a subclass of
-``ValueError``) and, hence, will not send the e-mail. It's your responsibility
-to validate all data before passing it to the e-mail functions.
+``recipient_list`` contains a newline (in either Unix, Windows or Mac style),
+the e-mail function (e.g. ``send_mail()``) will raise
+``django.core.mail.BadHeaderError`` (a subclass of ``ValueError``) and, hence,
+will not send the e-mail. It's your responsibility to validate all data before
+passing it to the e-mail functions.
+
+If a ``message`` contains headers at the start of the string, the headers will
+simply be printed as the first bit of the e-mail message.
Here's an example view that takes a ``subject``, ``message`` and ``from_email``
from the request's POST data, sends that to admin@example.com and redirects to
Please sign in to comment.
Something went wrong with that request. Please try again.