OpenSourcery

Drupal's core contact module allows users of a site to contact one another via email. Unfortunately, it also reveals the sender's email address. Normally, this is seen as fine behavior because the only person's email address that is at stake is the one taking the action. However, for a recent site, this violated the site's stated COPPA compliance, so we needed to alter the From and Reply-To headers sent with the email. As it turns out, this is quite an easy thing to do thanks to hook_mail_alter().

/**
 * Implementation of hook_mail_alter().
 */
function somemodulename_mail_alter(&$message) {
  if ($message['id'] == 'contact_user_mail') {
    // Set 'From' address to a no-reply rather than leaking student's email address.
    $mail = 'NO-REPLY@example.com';
    $message['from'] = $mail;
    foreach (array('Reply-To', 'From') as $header) {
      $message['headers'][$header] = $mail;
    }
  }
}

I was recently working with the Forward module. It's a pretty cool module that adds a link to "email this page to a friend".

Instead of a link, though, the client's design called for this feature to be in a block. With a few simple hooks, the form can be rendered somewhere else, and Drupal's form API handles the details. This example deals with the Forward module, but the same technique works in many situations.