PHP Mail function - Can all mails CC or BCC a certain person

[minetree]

I run a public site where a portion of client communication need to be monitored in order to maintain a certain level of customer service. Any incoming form mail which uses the PHP mail function needs to be CC or BCC to the admins.

I have the code and will be more than happy to post it - I just need someone to point me in the right direction. Is it something coded into the form function which generates the form - or should I look deeper into the core code to find what passes the information to the mail system?

Odd Noob Question..
Thanks,
M

[bretticus]

See the php mail function.

There has to be code in place on the form handler to build a message from the results of the form that the user fills out. However, I suspect that is already in place in the code you have.

To add a bcc (or more) to the mail function, simply append it to the string variable you are building for the header parameter to the mail function:

$headers = 'From: CEO <[e-mail]>' . "\r\n";
$headers .= 'Bcc: [e-mail]' . "\r\n";

[minetree]

But inside the form handler it doesn't appear to be there.

Here's the code: (I'm sorry if it's long but I dont know how to input it in frames)

	 class contact {
	/**
	 * Contact::ContactAgentForm()
	 *
	 * @param integer $listing_id This should hold the listing ID. Listing_id is used only if agent_id is not set
	 * @param integer $agent_id This should hold the agent id
	 * @return
	 */
	function ContactAgentForm($listing_id = 0, $agent_id = 0)
	{
		global $conn, $config, $lang;
		require_once($config['basepath'] . '/include/misc.inc.php');
		$misc = new misc();
		$display = '';
		$error = array();
		if ($agent_id == 0) {
			if ($listing_id != 0) {
				$sql_listing_id = $misc->make_db_safe($listing_id);
				$sql = 'SELECT userdb_id FROM ' . $config['table_prefix'] . 'listingsdb WHERE listingsdb_id = ' . $sql_listing_id;
				$recordSet = $conn->Execute($sql);
				if ($recordSet === false) {
					$misc->log_error($sql);
				}
				$agent_id = $misc->make_db_unsafe($recordSet->fields['userdb_id']);
			}
		}
		if (isset($_POST['message'])) {
			// Make sure there is a message
			if( ($_SESSION['security_code'] != md5($_POST['security_code'])) && $config["use_email_image_verification"] == 1 ) {
				$error[] = 'email_verification_code_not_valid';			
			}
			if (trim($_POST['name']) == '') {
				$error[] = 'email_no_name';
			}
			if (trim($_POST['email']) == '') {
				$error[] = 'email_no_email_address';
			}elseif ($misc->validate_email($_POST['email']) !== true) {
				$error[] = 'email_invalid_email_address';
			}
			if (trim($_POST['subject']) == '') {
				$error[] = 'email_no_subject';
			}
			if (trim($_POST['message']) == '') {
				$error[] = 'email_no_message';
			}
		}
		if (count($error) == 0 && isset($_POST['message'])) {
			// Grab Agents Email
			$sql_agent_id = $misc->make_db_safe($agent_id);
			$sql = 'SELECT userdb_emailaddress FROM ' . $config['table_prefix'] . 'userdb WHERE userdb_id = ' . $sql_agent_id;
			$recordSet = $conn->Execute($sql);
			if ($recordSet === false) {
				$misc->log_error($sql);
			}
			if ($config["include_senders_ip"] == 1) {
			    $_POST['message'] .= "\r\n" . $lang['senders_ip_address'] . $_SERVER["REMOTE_ADDR"];
			}
			if ($recordSet->RecordCount() != 0) {
				$emailaddress = $misc->make_db_unsafe($recordSet->fields['userdb_emailaddress']);
				// Send Mail
				$sent = $misc->send_email($_POST['name'], $_POST['email'], $emailaddress, $_POST['message'], $_POST['subject']);
				if ($sent === true) {
					$display .= $lang['email_listing_agent_sent'];
				}else {
					$display .= $sent;
				}
			}
		}else {
			if (count($error) != 0) {
				foreach ($error as $err) {
					$display .= '<div class="error_text">' . $lang[$err] . '</div>';
				}
			}
			$name = '';
			$email = '';
			$subject = '';
			if ($listing_id !== 0) {
				$subject = $lang['email_in_reference_to_listing'] . $listing_id;
			}
			$message = '';
			if (isset($_POST['message'])) {
				$email = stripslashes($_POST['email']);
				$name = stripslashes($_POST['name']);
				$message = stripslashes($_POST['message']);
				$subject = stripslashes($_POST['subject']);
			}
			$display .= '<form name="contact_agent" method="post" action="index.php?action=contact_agent&amp;popup=yes&amp;listing_id=' . $listing_id . '&amp;agent_id=' . $agent_id . '">
				<table  border="0" cellspacing="2" cellpadding="4">
					<tr>
						<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="name">' . $lang['email_your_name'] . '&nbsp;&nbsp;</label>
							<input id="name" name="name" value="' . $name . '" type="text" size="50">
						</td>
					</tr>
					<tr>
						<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="email">' . $lang['email_your_email'] . '&nbsp;&nbsp;&nbsp;</label>
							<input id="email" name="email" value="' . $email . '" type="text" size="50">
						</td>
					</tr>
					<tr>
						<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="subject">' . $lang['email_your_subject'] . '</label>
							<input id="subject" name="subject" value="' . $subject . '" type="text" size="50">
						</td>
					</tr>
					<tr>
						<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="message">' . $lang['email_your_message'] . '</label>
							<br />
							<br />
							<textarea id="message" name="message" rows="5" cols="50">' . $message . '</textarea>
						</td>
					</tr>';
					if($config["use_email_image_verification"] == 1 ) {
						$display .= '<tr>
							<td colspan="2"><img src="'.$config['baseurl'].'/include/class/captcha/captcha_image.php" /></td>
						</tr>
						<tr>
							<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="security_code">' . $lang['email_verification_code'] . '</label>
								<input id="security_code" name="security_code" type="text" />
							</td>
						</tr>';
					}
					$display .= '<tr>
						<td colspan="2"><input type="submit" name="Submit" value="' . $lang['email_send'] . '">
						</td>
					</tr>

			</table>
			</form>';
	}
	return $display;
}
/**
 * Contact::ContactFriendForm()
 *
 * @param integer $listing_id This should hold the listing ID that you aer emailing your friend about.
 * @return
 */
function ContactFriendForm($listing_id)
{
	global $conn, $config, $lang;
	require_once($config['basepath'] . '/include/misc.inc.php');
	$misc = new misc();
	$display = '';
	$error = array();
	if (isset($_POST['message'])) {
		// Make sure there is a message
		if( ($_SESSION['security_code'] != md5($_POST['security_code'])) && $config["use_email_image_verification"] == 1 ) {
			$error[] = 'email_verification_code_not_valid';			
		}
		if (trim($_POST['name']) == '') {
			$error[] = 'email_no_name';
		}
		if (trim($_POST['email']) == '') {
			$error[] = 'email_no_email_address';
		}
		elseif ($misc->validate_email($_POST['email']) !== true) {
			$error[] = 'email_invalid_email_address';
		}
		if (trim($_POST['friend_email']) == '') {
			$error[] = 'email_no_email_address';
		}elseif ($misc->validate_email($_POST['friend_email']) !== true) {
			$error[] = 'email_invalid_email_address';
		}
		if (trim($_POST['subject']) == '') {
			$error[] = 'email_no_subject';
		}
		if (trim($_POST['message']) == '') {
			$error[] = 'email_no_message';
		}
	}
	if (count($error) == 0 && isset($_POST['message'])) {
		// Send Mail
		$sent = $misc->send_email($_POST['name'], $_POST['email'], $_POST['friend_email'], $_POST['message'], $_POST['subject']);
		if ($sent === true) {
			$display .= $lang['email_listing_sent'] . ' ' . $_POST['friend_email'];
		}else {
			$display .= $sent;
		}
	}else {
		if (count($error) != 0) {
			foreach ($error as $err) {
				$display .= '<div class="error_text">' . $lang[$err] . '</div>';
			}
		}
		$name = '';
		$email = '';
		$subject = '';
		// $friend_name = '';
		$friend_email = '';
		$message = '';
		if (isset($_POST['message'])) {
			$email = stripslashes($_POST['email']);
			$name = stripslashes($_POST['name']);
			$message = stripslashes($_POST['message']);
			$subject = stripslashes($_POST['subject']);
			// $friend_name = $_POST['friend_name'];
			$friend_email = stripslashes($_POST['friend_email']);
		}else {
			$subject = $lang['email_in_reference_to_listing'] . $listing_id;
			$message = $lang['email_listing_default_message'] . "\r\n\r\n" . $config['baseurl'] . '/index.php?action=listingview&amp;listingID=' . $listing_id;
		}
		$display .= '<form name="contact_friend" method="post" action="index.php?action=contact_friend&amp;popup=yes&amp;listing_id=' . $listing_id . '">
			<table  border="0" cellspacing="2" cellpadding="4">
				<tr>
					<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="name">' . $lang['email_your_name'] . '&nbsp;&nbsp;</label>
						<input id="name" name="name" value="' . $name . '" type="text" size="50">
					</td>
				</tr>
				<tr>
					<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="email">' . $lang['email_your_email'] . '&nbsp;&nbsp;&nbsp;</label>
						<input id="email" name="email" value="' . $email . '" type="text" size="50">
					</td>
				</tr>
				<tr>
					<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="email">' . $lang['email_friend_email'] . '&nbsp;&nbsp;&nbsp;</label>
						<input id="email" name="friend_email" value="' . $friend_email . '" type="text" size="50">
					</td>
				</tr>
				<tr>
					<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="subject">' . $lang['email_your_subject'] . '</label>
						<input id="subject" name="subject" value="' . $subject . '" type="text" size="50">
					</td>
				</tr>
				<tr>
					<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="message">' . $lang['email_your_message'] . '</label>
						<br />
						<br />
						<textarea id="message" name="message" rows="5" cols="50">' . $message . '</textarea>
					</td>
				</tr>
				</tr>';
				if($config["use_email_image_verification"] == 1 ) {
					$display .= '<tr>
						<td colspan="2"><img src="'.$config['baseurl'].'/include/class/captcha/captcha_image.php" /></td>
					</tr>
					<tr>
						<td colspan="2" style="vertical-align: top" class="TitleColor"><label for="security_code">' . $lang['email_verification_code'] . '</label>
							<input id="security_code" name="security_code" type="text" />
						</td>
					</tr>';
				}
				$display .= '<tr>
				<tr>
					<td colspan="2"><input type="submit" name="Submit" value="' . $lang['email_send'] . '">
					</td>
				</tr>
			</table>
			</form>';
	}
	return $display;
}
}

?>

[bretticus]

That's not the whole form handler. You have a misc class that it uses (included.) It has a custom method called send_email()...

/* starts at line 61 */
// Send Mail
$sent = $misc->send_email($_POST['name'], $_POST['email'], $emailaddress, $_POST['message'], $_POST['subject']);

You'll need to modify that method in the misc class or not use it in place of the mail function. However, since mail() is inherently insecure, you might just wanna add another parameter for bcc to the send_mail() method. The following is a very rough approximation of the misc class:

class misc {
 	 //...
 	function send_email($name, $to, $friend, $message, $subject, $bcc="")
 	{
 		//...code is in here, you need to add to the header as instructed in my first post. 
 	}
 	//...
 }

[minetree]

I found the code in the misc_class - am I getting a little warmer?

$emailaddress = $misc->make_db_unsafe($recordSet->fields['userdb_emailaddress']);
				// Send Mail
				$sent = $misc->send_email($_POST['name'], $_POST['email'], $emailaddress, $_POST['message'], $_POST['subject']);
				if ($sent === true) {
					$display .= $lang['email_listing_agent_sent'];
				}else {
					$display .= $sent;
				}
			}
		}else {
			if (count($error) != 0) {
				foreach ($error as $err) {
					$display .= '<div class="error_text">' . $lang[$err] . '</div>';
				}
			}
			$name = '';
			$email = '';
			$subject = '';
			if ($listing_id !== 0) {
				$subject = $lang['email_in_reference_to_listing'] . $listing_id;
			}
			$message = '';
			if (isset($_POST['message'])) {
				$email = stripslashes($_POST['email']);
				$name = stripslashes($_POST['name']);
				$message = stripslashes($_POST['message']);
				$subject = stripslashes($_POST['subject']);
			}