Fix mail format + add token in form BT#15596

main/inc/email_editor.php

@@ -68,10 +68,17 @@ $defaults = [
 $form->setDefaults($defaults);
 
 if ($form->validate()) {
+    $check = Security::check_token();
+    Security::clear_token();
+    if ($check) {
+        Security::clear_token();
         $values = $form->getSubmitValues();
-    $text = Security::remove_XSS($values['email_text'])."\n\n---\n".get_lang('EmailSentFromLMS').' '.api_get_path(WEB_PATH);
+        $text = nl2br($values['email_text']).'<br /><br /><br />'.get_lang('EmailSentFromLMS').' '.api_get_path(
-    $email_administrator = Security::remove_XSS($values['dest']);
+                WEB_PATH
-    $title = Security::remove_XSS($values['email_title']);
+            );
+        $email_administrator = $values['dest'];
+        $title = $values['email_title'];
+
         if (!empty($_user['mail'])) {
             api_mail_html(
                 '',
@@ -79,7 +86,7 @@ if ($form->validate()) {
                 $title,
                 $text,
                 api_get_person_name($_user['firstname'], $_user['lastname']),
-            '',
+                $_user['mail'],
                 [
                     'reply_to' => [
                         'mail' => $_user['mail'],
@@ -96,11 +103,17 @@ if ($form->validate()) {
                 get_lang('Anonymous')
             );
         }
+
+        Display::addFlash(Display::return_message(get_lang('MessageSent')));
         $orig = Session::read('origin_url');
         Session::erase('origin_url');
         header('Location:'.$orig);
         exit;
+    }
 }
+
+$form->addHidden('sec_token', Security::get_token());
+
 Display::display_header(get_lang('SendEmail'));
 $form->display();
 Display::display_footer();