|
|
|
@ -31,7 +31,7 @@ class PHPMailer
|
|
|
|
|
* The PHPMailer Version number.
|
|
|
|
|
* @var string
|
|
|
|
|
*/
|
|
|
|
|
public $Version = '5.2.19';
|
|
|
|
|
public $Version = '5.2.20';
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Email priority.
|
|
|
|
@ -1364,19 +1364,24 @@ class PHPMailer
|
|
|
|
|
*/
|
|
|
|
|
protected function sendmailSend($header, $body)
|
|
|
|
|
{
|
|
|
|
|
if (!empty($this->Sender)) {
|
|
|
|
|
// CVE-2016-10033, CVE-2016-10045: Don't pass -f if characters will be escaped.
|
|
|
|
|
if (!empty($this->Sender) and self::isShellSafe($this->Sender)) {
|
|
|
|
|
if ($this->Mailer == 'qmail') {
|
|
|
|
|
$sendmail = sprintf('%s -f%s', escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
|
|
|
|
|
$sendmailFmt = '%s -f%s';
|
|
|
|
|
} else {
|
|
|
|
|
$sendmail = sprintf('%s -oi -f%s -t', escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
|
|
|
|
|
$sendmailFmt = '%s -oi -f%s -t';
|
|
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
if ($this->Mailer == 'qmail') {
|
|
|
|
|
$sendmail = sprintf('%s', escapeshellcmd($this->Sendmail));
|
|
|
|
|
$sendmailFmt = '%s';
|
|
|
|
|
} else {
|
|
|
|
|
$sendmail = sprintf('%s -oi -t', escapeshellcmd($this->Sendmail));
|
|
|
|
|
$sendmailFmt = '%s -oi -t';
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// TODO: If possible, this should be changed to escapeshellarg. Needs thorough testing.
|
|
|
|
|
$sendmail = sprintf($sendmailFmt, escapeshellcmd($this->Sendmail), $this->Sender);
|
|
|
|
|
|
|
|
|
|
if ($this->SingleTo) {
|
|
|
|
|
foreach ($this->SingleToArray as $toAddr) {
|
|
|
|
|
if (!@$mail = popen($sendmail, 'w')) {
|
|
|
|
@ -1422,6 +1427,40 @@ class PHPMailer
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Fix CVE-2016-10033 and CVE-2016-10045 by disallowing potentially unsafe shell characters.
|
|
|
|
|
*
|
|
|
|
|
* Note that escapeshellarg and escapeshellcmd are inadequate for our purposes, especially on Windows.
|
|
|
|
|
* @param string $string The string to be validated
|
|
|
|
|
* @see https://github.com/PHPMailer/PHPMailer/issues/924 CVE-2016-10045 bug report
|
|
|
|
|
* @access protected
|
|
|
|
|
* @return boolean
|
|
|
|
|
*/
|
|
|
|
|
protected static function isShellSafe($string)
|
|
|
|
|
{
|
|
|
|
|
// Future-proof
|
|
|
|
|
if (escapeshellcmd($string) !== $string
|
|
|
|
|
or !in_array(escapeshellarg($string), array("'$string'", "\"$string\""))
|
|
|
|
|
) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$length = strlen($string);
|
|
|
|
|
|
|
|
|
|
for ($i = 0; $i < $length; $i++) {
|
|
|
|
|
$c = $string[$i];
|
|
|
|
|
|
|
|
|
|
// All other characters have a special meaning in at least one common shell, including = and +.
|
|
|
|
|
// Full stop (.) has a special meaning in cmd.exe, but its impact should be negligible here.
|
|
|
|
|
// Note that this does permit non-Latin alphanumeric characters based on the current locale.
|
|
|
|
|
if (!ctype_alnum($c) && strpos('@_-.', $c) === false) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Send mail using the PHP mail() function.
|
|
|
|
|
* @param string $header The message headers
|
|
|
|
@ -1442,7 +1481,10 @@ class PHPMailer
|
|
|
|
|
$params = null;
|
|
|
|
|
//This sets the SMTP envelope sender which gets turned into a return-path header by the receiver
|
|
|
|
|
if (!empty($this->Sender) and $this->validateAddress($this->Sender)) {
|
|
|
|
|
$params = sprintf('-f%s', escapeshellarg($this->Sender));
|
|
|
|
|
// CVE-2016-10033, CVE-2016-10045: Don't pass -f if characters will be escaped.
|
|
|
|
|
if (self::isShellSafe($this->Sender)) {
|
|
|
|
|
$params = sprintf('-f%s', $this->Sender);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if (!empty($this->Sender) and !ini_get('safe_mode') and $this->validateAddress($this->Sender)) {
|
|
|
|
|
$old_from = ini_get('sendmail_from');
|
|
|
|
|