fix email address injection which could enable spam, closes #40

serv.cc

@@ -233,6 +233,7 @@ int trifectaMain(int argc, const char**argv)
     cr.res.status = 200;
 
     cr.log({{"action", "view"}, {"imageId", imgid}});
+    // this is needed for SVG which can contain embedded JavaScript (yes)
     cr.res.set_header("Content-Security-Policy", "script-src ;");
     return make_pair(s, get<string>(results[0]["content_type"]));
   });

support.cc

@@ -155,6 +155,11 @@ std::string getIP(const httplib::Request& req)
 // do not put UTF-8 or anything in this, it won't work. US-ASCII. 
 void sendAsciiEmailAsync(const std::string& server, const std::string& from, const std::string& to, const std::string& subject, const std::string& textBody)
 {
+  const char* allowed="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_+-.@";
+  if(from.find_first_not_of(allowed) != string::npos || to.find_first_not_of(allowed) != string::npos) {
+    throw std::runtime_error("Illegal character in from or to address");
+  }
+
   ComboAddress mailserver(server, 25);
   Socket s(mailserver.sin4.sin_family, SOCK_STREAM);