.user.ini sendmail_from override broken in 7.0.2

There is an error with this patch. I have hundreds of sites hosted on Nexcess (now LiquidWeb) and Nexcess by defaults hosts them on unique random domains (i.e. [random].nxcli.io), but aliases the live domain to your site. Because of this, the server configure sendmail path looks like this:

/sbin/sendmail -t -i -f postmaster@[random].nxcli.io

In order to have mail sent from the website validate, we have a .user.ini file set sendmail_from on every site with something like this:

[email protected]

This method worked up until WordPress 7.0 which includes PHPMailer 7.0.2 and pull request #3283 . The one line causing this issue is this:

if (self::isShellSafe($this->Sender) && strpos($phpmailer_path, ' -f') === false) {

Because of the way it creates the command it creates a command with two -f like this:

/sbin/sendmail -t -i -f postmaster@[random].nxcli.io -oi [email protected] -t

Which is then ignored by the new guard. But we need both in order to override the original address. Because of this change, none of our sites can send mail anymore and it's causing huge problems. My solution for now is to override the logic with this patch:

add_action('phpmailer_init', function ($phpmailer) {
    $phpmailer->isSendmail();
    $sendmail_from_value = ini_get('sendmail_from');
    if (empty($sendmail_from_value)) return;
    $phpmailer->Sender = $sendmail_from_value;
}, 999);

isSendmail() reads in the .ini settings but crucially switches it from 'mail' to 'sendmail' which then uses sendmailSend() which doesn't have the guard in place. I am then able to re-set the From address from the .user.ini and send mail successfully again. Maybe a better patch would be to replace the existing -f flag instead of concatenating it? Something like this maybe?

if (self::isShellSafe($this->Sender)) {
    $phpmailer_path = preg_replace('/\s-f\S+/', '', $phpmailer_path);
    $params = sprintf('-f%s', $this->Sender);
}

That way it's the best of both worlds. For confirmation I did some testing as well, the _gf suffix is Gravity Forms, the _ini suffix is from .user.ini:

In v6.9.4

From: [email protected]
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=###.###.###.###; helo=cloudhost-#######.us-midwest-1.nxcli.net; [email protected]; receiver=<UNKNOWN>

In v7.0

From: [email protected]
Received-SPF: None (mailfrom) identity=mailfrom; client-ip=###.###.###.###; helo=cloudhost--#######..us-midwest-1.nxcli.net; envelope-from=postmaster@[random].nxcli.io; receiver=<UNKNOWN>

In v7.0 when I revert the one line to what it was in v6.9.4

From: [email protected]
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=###.###.###.###; helo=cloudhost--#######.us-midwest-1.nxcli.net; [email protected]; receiver=<UNKNOWN>

So I can say definitively that one line is causing the problem. Hopefully this can be patched and then integrated upstream into WordPress 7.0.1 or something. Thanks for your attention to this!