Fix so invalid smtp_helo_host is never used, fallback to localhost (#6408)

CHANGELOG

@@ -3,6 +3,7 @@ CHANGELOG Roundcube Webmail
 
 - Password: Added 'modoboa' driver (#6361)
 - Plugin API: Added 'raise_error' hook (#6199)
+- Fix so invalid smtp_helo_host is never used, fallback to localhost (#6408)
 - Fix custom logo size in Elastic (#6424)
 - Fix listing the same attachment multiple times on forwarded messages
 - Fix compatibility with MySQL 8 - error on 'system' table use

program/lib/Roundcube/rcube_smtp.php

@@ -98,13 +98,10 @@ class rcube_smtp
         // Handle per-host socket options
         rcube_utils::parse_socket_options($CONFIG['smtp_conn_options'], $smtp_host);
 
-        if (!empty($CONFIG['smtp_helo_host'])) {
-            $helo_host = $CONFIG['smtp_helo_host'];
-        }
-        else if (!empty($_SERVER['SERVER_NAME'])) {
-            $helo_host = rcube_utils::server_name();
-        }
-        else {
+        // Use valid EHLO/HELO host (#6408)
+        $helo_host = $CONFIG['smtp_helo_host'] ?: rcube_utils::server_name();
+        $helo_host = rcube_utils::idn_to_ascii($helo_host);
+        if (!preg_match('/^[a-zA-Z0-9.:-]+$/', $helo_host)) {
             $helo_host = 'localhost';
         }