learningworks / moodle-block_sidebar_contact Goto Github PK

sendmail.php should check the config var get_config('block_sidebar_contact', 'unauth_sidebar_contact'); and if not set it should use require_login on the page and use the global $USER to obtain the persons e-mail/name.

I'd also prefer to see a sesskey check in there and PARAM_RAW shouldn't really be used for the "username" or email fields .

You're also allowing raw user content to be added to the $headers var which I think can be used to add cc and bcc fields which could allow this script to operate as a SPAM relay