a8cteam51 / safety-net

Scrub options, deactivate denylisted plugins, and delete user data on development sites.
20 stars 1 forks source link

Investigate MailPoet #82

Open nate-allen opened 1 year ago

nate-allen commented 1 year ago

It looks like MailPoet can be setup to send emails without using wp_mail. Look into how it does send email, and if we can disable that feature. If not, we may need to add the plugin to the deny list.

NickGreen commented 1 year ago

Adding plugin to the denylist in the short term. If this issue turns up a better solution, feel free to remove it as needed.

gin0115 commented 1 year ago

The mailer options are saved in the {prefix_}mailpoet_settings table.


You can force the mailer to use PHP by setting

There is another DB key called web_host, this can be set to manual (probably no needed)


Or you can set fake SMTP using

BrianHenryIE commented 9 months ago

I wasn't aware of that hook solution.

I approached a similar problem by loading the PHPMailer class early and replacing it with a subclass of my own where I overrode the send method.

https://github.com/BrianHenryIE/bh-wp-one-click-list-unsubscribe-mailto-header/blob/50fbdf36ae028d0d09e8849ef9ffd0da170980bf/src/Integrations/class-mailpoet.php#L50

https://github.com/BrianHenryIE/bh-wp-one-click-list-unsubscribe-mailto-header/blob/50fbdf36ae028d0d09e8849ef9ffd0da170980bf/src/API/class-phpmailer-intercept.php#L7

Didn't really test it much.