Just playing with Magento for the first time and creating a few test customer accounts. I have discovered that if you view full headers of the welcome email, you will see the following:

X-Source-Args: /usr/bin/php /home/ACCOUNT NAME/public_html/index.php

There are lots of other instances in this welcome email's headers where the name of the cPanel account (which is the same as the installation directory on the server) is exposed. I thought it wasn't the best practice for PHP scripts to expose the installation path? Is it?

Edit: including code inside the email template as requested by Yorrd in the comments

{{template config_path="design/email/header"}}
{{inlinecss file="email-inline.css"}}

<table cellpadding="0" cellspacing="0" border="0">
        <td class="action-content">
            <h1>Welcome to {{var store.getFrontendName()}}</h1>
            <p>To log in when visiting our site just click <a href="{{store url="customer/account/"}}">Login</a> or <a href="{{store url="customer/account/"}}">My Account</a> at the top of every page, and then enter your email address and password.</p>
            <p class="highlighted-text">
                Use the following values when prompted to log in:<br/>
                <strong>Email</strong>: {{var customer.email}}<br/>
                <strong>Password</strong>: {{htmlescape var=$customer.password}}
            <p>When you log in to your account, you will be able to do the following:</p>
                <li>Proceed through checkout faster when making a purchase</li>
                <li>Check the status of orders</li>
                <li>View past orders</li>
                <li>Make changes to your account information</li>
                <li>Change your password</li>
                <li>Store alternative addresses (for shipping to multiple family members and friends!)</li>
                If you have any questions, please feel free to contact us via our Support page.
                {{depend store_phone}} or by phone at <a href="tel:{{var phone}}">{{var store_phone}}</a>{{/depend}}

{{template config_path="design/email/footer"}}
  • please edit your question and add the code inside the email template file. I'm pretty sure there's a wrong character in there. – Yorrd May 13 '15 at 7:58
  • OK, but I didn't change anything in that template. This is a brand new installation. – Knocks X May 13 '15 at 8:10
  • ok this is weird, I take back everything I said... unfortunately this isn't much help to you I'm afraid :/ – Yorrd May 13 '15 at 8:23

There is an option in cPanel WHM to turn this header on/off globally but, you could, if you've access to php.ini on your account and the method by which you're running PHP allows the use of user php.ini files, turn it off by setting the variable:

mail.add_x_header = Off

This will stop the headers appearing in your emails from the application.

More info in the PHP docs - Mail Runtime Configuration Options

I don't have a server running cPanel to tell you exactly where the global setting lives within WHM but, the cPanel documentation for your version will cover it.

Hope this helps.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.