5.0.4

Bugfix

• [security] On Grav 2.0, Twig in a form's email settings now runs under Grav's content sandbox, so someone who can only edit pages can no longer use an email action to run commands on the server (GHSA-gh8j-q67c-j53f). Requires Grav 2.0.16 or later.
• Email settings can still read your site configuration and this plugin's own address settings, so {{ config.site.emails.sales }} and {{ config.plugins.email.to }} keep working, but they can no longer read your mail server password or any other plugin's settings.
• Grav 1.7 has no Twig content sandbox, so email settings behave there exactly as they did before, and the plugin still runs on the PHP versions that line supports.