diogomartino / sampmailjs

Send mails through SAMP

SAMPMailJS

Installation

Simply install to your project:

sampctl package install Fairuz-Afdhal/SAMPMailJS

Include in your code and begin using the library:

#include <SAMPMailJS>

Usage

SendEmail(name[], to[], subject[], text[], bool:isTemplate = false, templateName[] = "default.html")

 name: The name that will appear next to your email (string)
 to: The email address you want to send the email to (string)
 subject: The subject of your email (string)
 isTemplate: When set to false, it will only send the text you input in the argument text. When set to true, it will try to use a template. (boolean)
 templateName: The file name of the template that must be in the same folder of your NodeJS script. (string)

Testing

To test, simply run the package:

sampctl package run

sampmailjs's Issues

Major security issue: password check is faulty

The password check that is supposed to return a HTTP 403 Forbidden is faulty and creates a major security hole since it allows anyone to supply an empty password parameter (or omit the parameter entirely), allowing them to send illicit mails from the server.

SAMPMailJS/sampmail.js

Lines 54 to 57 in 381de7b

	if (urlObj['query']['pw'] != config.httpPassword && urlObj['query']['pw'] != 'undefined' && urlObj['query']['pw'] != '' && urlObj['query']['pw'] != null) {
	logResponse(req.connection.remoteAddress, 403, 'Wrong password', res);
	return;
	}

Reproduction in browser console:

Password param supplied, but empty:

config = { httpPassword: "abc123" }
urlObj = { query: { pw: "" }}

urlObj['query']['pw'] != config.httpPassword && urlObj['query']['pw'] != 'undefined' && urlObj['query']['pw'] != '' && urlObj['query']['pw'] != null

Result:

false

When it should be true to send the 403 Forbidden.

Password param not supplied:

config = { httpPassword: "abc123" }
urlObj = { query: {}}

urlObj['query']['pw'] != config.httpPassword && urlObj['query']['pw'] != 'undefined' && urlObj['query']['pw'] != '' && urlObj['query']['pw'] != null

Result:

false

When, again, it should be true to send the 403 Forbidden.

Bad UTF-8

Hello! The Russian text in UTF-8 is not well coded.
It says - Information about you, of course in Russian)

https://i.imgur.com/lK8UCYj.png