CVE-2012-0795

A remote authenticated user can set a crafted email address or Jabber ID in their messaging preferences. Because the email address was not sanitized with `clean_param(..., PARAM_EMAIL)` before being used in `send_message()`, an attacker could cause the system to send messages to arbitrary or malformed addresses [CWE-20]. Additionally, the unescaped output in `config_form()` could lead to reflected cross-site scripting (XSS) if a malicious value is stored and later rendered in the preferences form [patch_id=6650973][patch_id=6650974].

The vulnerability resides in `message/output/email/message_output_email.php` and `message/output/jabber/message_output_jabber.php`. In the email output plugin, the `send_message()` function did not sanitize the user's messaging preference email address before using it, and the `config_form()` function did not validate the email address or escape output. In the Jabber output plugin, the `config_form()` function did not escape the Jabber ID before rendering it in an HTML input value attribute.

The patches address two issues. First, in `send_message()`, the email preference is now sanitized via `clean_param($emailmessagingpreference, PARAM_EMAIL)` before being used, preventing delivery to invalid addresses [patch_id=6650975]. Second, in `config_form()`, the email and Jabber ID values are escaped with `s()` before being output in HTML, preventing XSS [patch_id=6650973][patch_id=6650974]. Additionally, `validate_email()` is called to detect invalid addresses and display an error message, and the input field is built using `html_writer::empty_tag()` for safer attribute handling [patch_id=6650976][patch_id=6650978].