From ff7542bfb9648a8970bd6ff767bb62a647f705ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 12 Mar 2013 08:43:21 +0100
Subject: Don't show fake address - phishing prevention (#1488981)

---
 program/steps/mail/func.inc | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'program/steps/mail/func.inc')

diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 4a3476320..137e87d49 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -1444,6 +1444,11 @@ function rcmail_address_string($input, $max=null, $linked=false, $addicon=null,
     $mailto = $part['mailto'];
     $string = $part['string'];
 
+    // phishing email prevention (#1488981), e.g. "valid@email.addr <phishing@email.addr>"
+    if ($name && $name != $mailto && strpos($name, '@')) {
+      $name = '';
+    }
+
     // IDNA ASCII to Unicode
     if ($name == $mailto)
       $name = rcube_idn_to_utf8($name);
-- 
cgit v1.2.3