mirror of
https://github.com/bdnugget/php-src.git
synced 2026-11-11 11:10:49 +00:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Derick Rethans
|
ec0da1c35a |
No files matched your search
@@ -1,6 +1,6 @@
|
||||
PHP NEWS
|
||||
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||
29 Apr 2021, PHP 7.4.18
|
||||
15 Apr 2021, PHP 7.4.18RC1
|
||||
|
||||
- Core:
|
||||
. Fixed bug #80781 (Error handler that throws ErrorException infinite loop).
|
||||
@@ -17,13 +17,6 @@ PHP NEWS
|
||||
. Fixed bug #80024 (Duplication of info about inherited socket after pool
|
||||
removing). (Jakub Zelenka)
|
||||
|
||||
- FTP:
|
||||
. Fixed bug #80880 (SSL_read on shutdown, ftp/proc_open). (cmb, Jakub
|
||||
Zelenka)
|
||||
|
||||
- Imap:
|
||||
. Fixed bug #80710 (imap_mail_compose() header injection). (cmb, Stas)
|
||||
|
||||
- Intl:
|
||||
. Fixed bug #80763 (msgfmt_format() does not accept DateTime references).
|
||||
(cmb)
|
||||
@@ -38,12 +31,8 @@ PHP NEWS
|
||||
. Fixed bug #80837 (Calling stmt_store_result after fetch doesn't throw an
|
||||
error). (Kamil Tekiela)
|
||||
|
||||
- Opcache:
|
||||
- opcache:
|
||||
. Fixed bug #80805 (create simple class and get error in opcache.so). (Nikita)
|
||||
. Fixed bug #80950 (Variables become null in if statements). (Nikita)
|
||||
|
||||
- Pcntl:
|
||||
. Fixed bug #79812 (Potential integer overflow in pcntl_exec()). (cmb)
|
||||
|
||||
- PCRE:
|
||||
. Fixed bug #80866 (preg_split ignores limit flag when pattern with \K has
|
||||
@@ -53,10 +42,6 @@ PHP NEWS
|
||||
. Fixed bug #80783 (PDO ODBC truncates BLOB records at every 256th byte).
|
||||
(cmb)
|
||||
|
||||
- PDO_pgsql:
|
||||
. Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
|
||||
(Matteo)
|
||||
|
||||
- phpdbg:
|
||||
. Fixed bug #80757 (Exit code is 0 when could not open file). (Felipe)
|
||||
|
||||
@@ -65,18 +50,12 @@ PHP NEWS
|
||||
. Fixed bug #80889 (Cannot set save handler when save_handler is invalid).
|
||||
(cmb)
|
||||
|
||||
- SOAP:
|
||||
. Fixed bug #69668 (SOAP special XML characters in namespace URIs not
|
||||
encoded). (cmb)
|
||||
|
||||
- Standard:
|
||||
. Fixed bug #80771 (phpinfo(INFO_CREDITS) displays nothing in CLI). (cmb)
|
||||
. Fixed bug #78719 (http wrapper silently ignores long Location headers).
|
||||
(cmb)
|
||||
. Fixed bug #80771 (phpinfo(INFO_CREDITS) displays nothing in CLI). (cmb)
|
||||
. Fixed bug #80838 (HTTP wrapper waits for HTTP 1 response after HTTP 101).
|
||||
(manuelm)
|
||||
. Fixed bug #80915 (Taking a reference to $_SERVER hides its values from
|
||||
phpinfo()). (Rowan Tommins)
|
||||
|
||||
04 Mar 2021, php 7.4.16
|
||||
|
||||
|
||||
+1
-1
@@ -17,7 +17,7 @@ dnl Basic autoconf initialization, generation of config.nice.
|
||||
dnl ----------------------------------------------------------------------------
|
||||
|
||||
AC_PREREQ([2.68])
|
||||
AC_INIT([PHP],[7.4.18],[https://bugs.php.net],[php],[https://www.php.net])
|
||||
AC_INIT([PHP],[7.4.18RC1],[https://bugs.php.net],[php],[https://www.php.net])
|
||||
AC_CONFIG_SRCDIR([main/php_version.h])
|
||||
AC_CONFIG_AUX_DIR([build])
|
||||
AC_PRESERVE_HELP_ORDER
|
||||
|
||||
@@ -3551,23 +3551,6 @@ PHP_FUNCTION(imap_fetch_overview)
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
static zend_bool header_injection(zend_string *str, zend_bool adrlist)
|
||||
{
|
||||
char *p = ZSTR_VAL(str);
|
||||
|
||||
while ((p = strpbrk(p, "\r\n")) != NULL) {
|
||||
if (!(p[0] == '\r' && p[1] == '\n')
|
||||
/* adrlists do not support folding, but swallow trailing line breaks */
|
||||
&& !((adrlist && p[1] == '\0')
|
||||
/* other headers support folding */
|
||||
|| !adrlist && (p[1] == ' ' || p[1] == '\t'))) {
|
||||
return 1;
|
||||
}
|
||||
p++;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* {{{ proto string imap_mail_compose(array envelope, array body)
|
||||
Create a MIME message based on given envelope and body sections */
|
||||
PHP_FUNCTION(imap_mail_compose)
|
||||
@@ -3588,13 +3571,6 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
return;
|
||||
}
|
||||
|
||||
#define CHECK_HEADER_INJECTION(zstr, adrlist, header) \
|
||||
if (header_injection(zstr, adrlist)) { \
|
||||
php_error_docref(NULL, E_WARNING, "header injection attempt in " header); \
|
||||
RETVAL_FALSE; \
|
||||
goto done; \
|
||||
}
|
||||
|
||||
#define PHP_RFC822_PARSE_ADRLIST(target, value) \
|
||||
str_copy = estrndup(Z_STRVAL_P(value), Z_STRLEN_P(value)); \
|
||||
rfc822_parse_adrlist(target, str_copy, "NO HOST"); \
|
||||
@@ -3603,57 +3579,46 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
env = mail_newenvelope();
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "remail", sizeof("remail") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "remail");
|
||||
env->remail = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "return_path", sizeof("return_path") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "return_path");
|
||||
PHP_RFC822_PARSE_ADRLIST(&env->return_path, pvalue);
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "date", sizeof("date") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "date");
|
||||
env->date = (unsigned char*)cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "from", sizeof("from") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "from");
|
||||
PHP_RFC822_PARSE_ADRLIST(&env->from, pvalue);
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "reply_to", sizeof("reply_to") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "reply_to");
|
||||
PHP_RFC822_PARSE_ADRLIST(&env->reply_to, pvalue);
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "in_reply_to", sizeof("in_reply_to") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "in_reply_to");
|
||||
env->in_reply_to = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "subject", sizeof("subject") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "subject");
|
||||
env->subject = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "to", sizeof("to") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "to");
|
||||
PHP_RFC822_PARSE_ADRLIST(&env->to, pvalue);
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "cc", sizeof("cc") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "cc");
|
||||
PHP_RFC822_PARSE_ADRLIST(&env->cc, pvalue);
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "bcc", sizeof("bcc") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "bcc");
|
||||
PHP_RFC822_PARSE_ADRLIST(&env->bcc, pvalue);
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(envelope), "message_id", sizeof("message_id") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "message_id");
|
||||
env->message_id=cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
|
||||
@@ -3664,7 +3629,6 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pvalue), env_data) {
|
||||
custom_headers_param = mail_newbody_parameter();
|
||||
convert_to_string_ex(env_data);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(env_data), 0, "custom_headers");
|
||||
custom_headers_param->value = (char *) fs_get(Z_STRLEN_P(env_data) + 1);
|
||||
custom_headers_param->attribute = NULL;
|
||||
memcpy(custom_headers_param->value, Z_STRVAL_P(env_data), Z_STRLEN_P(env_data) + 1);
|
||||
@@ -3703,7 +3667,6 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body charset");
|
||||
tmp_param = mail_newbody_parameter();
|
||||
tmp_param->value = cpystr(Z_STRVAL_P(pvalue));
|
||||
tmp_param->attribute = cpystr("CHARSET");
|
||||
@@ -3716,11 +3679,9 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
SEPARATE_ARRAY(pvalue);
|
||||
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
|
||||
if (key == NULL) continue;
|
||||
CHECK_HEADER_INJECTION(key, 0, "body disposition key");
|
||||
disp_param = mail_newbody_parameter();
|
||||
disp_param->attribute = cpystr(ZSTR_VAL(key));
|
||||
convert_to_string_ex(disp_data);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body disposition value");
|
||||
disp_param->value = (char *) fs_get(Z_STRLEN_P(disp_data) + 1);
|
||||
memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
|
||||
disp_param->next = tmp_param;
|
||||
@@ -3731,22 +3692,18 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "subtype", sizeof("subtype") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body subtype");
|
||||
bod->subtype = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "id", sizeof("id") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body id");
|
||||
bod->id = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "description", sizeof("description") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body description");
|
||||
bod->description = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition.type", sizeof("disposition.type") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body disposition.type");
|
||||
bod->disposition.type = (char *) fs_get(Z_STRLEN_P(pvalue) + 1);
|
||||
memcpy(bod->disposition.type, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue)+1);
|
||||
}
|
||||
@@ -3756,11 +3713,9 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
SEPARATE_ARRAY(pvalue);
|
||||
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
|
||||
if (key == NULL) continue;
|
||||
CHECK_HEADER_INJECTION(key, 0, "body type.parameters key");
|
||||
disp_param = mail_newbody_parameter();
|
||||
disp_param->attribute = cpystr(ZSTR_VAL(key));
|
||||
convert_to_string_ex(disp_data);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body type.parameters value");
|
||||
disp_param->value = (char *) fs_get(Z_STRLEN_P(disp_data) + 1);
|
||||
memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
|
||||
disp_param->next = tmp_param;
|
||||
@@ -3791,7 +3746,6 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "md5", sizeof("md5") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body md5");
|
||||
bod->md5 = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
} else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) {
|
||||
@@ -3824,7 +3778,6 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body charset");
|
||||
tmp_param = mail_newbody_parameter();
|
||||
tmp_param->value = (char *) fs_get(Z_STRLEN_P(pvalue) + 1);
|
||||
memcpy(tmp_param->value, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1);
|
||||
@@ -3838,11 +3791,9 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
SEPARATE_ARRAY(pvalue);
|
||||
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
|
||||
if (key == NULL) continue;
|
||||
CHECK_HEADER_INJECTION(key, 0, "body type.parameters key");
|
||||
disp_param = mail_newbody_parameter();
|
||||
disp_param->attribute = cpystr(ZSTR_VAL(key));
|
||||
convert_to_string_ex(disp_data);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body type.parameters value");
|
||||
disp_param->value = (char *)fs_get(Z_STRLEN_P(disp_data) + 1);
|
||||
memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
|
||||
disp_param->next = tmp_param;
|
||||
@@ -3853,22 +3804,18 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "subtype", sizeof("subtype") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body subtype");
|
||||
bod->subtype = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "id", sizeof("id") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body id");
|
||||
bod->id = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "description", sizeof("description") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body description");
|
||||
bod->description = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition.type", sizeof("disposition.type") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body disposition.type");
|
||||
bod->disposition.type = (char *) fs_get(Z_STRLEN_P(pvalue) + 1);
|
||||
memcpy(bod->disposition.type, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue)+1);
|
||||
}
|
||||
@@ -3878,11 +3825,9 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
SEPARATE_ARRAY(pvalue);
|
||||
ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
|
||||
if (key == NULL) continue;
|
||||
CHECK_HEADER_INJECTION(key, 0, "body disposition key");
|
||||
disp_param = mail_newbody_parameter();
|
||||
disp_param->attribute = cpystr(ZSTR_VAL(key));
|
||||
convert_to_string_ex(disp_data);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body disposition value");
|
||||
disp_param->value = (char *) fs_get(Z_STRLEN_P(disp_data) + 1);
|
||||
memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
|
||||
disp_param->next = tmp_param;
|
||||
@@ -3913,7 +3858,6 @@ PHP_FUNCTION(imap_mail_compose)
|
||||
}
|
||||
if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "md5", sizeof("md5") - 1)) != NULL) {
|
||||
convert_to_string_ex(pvalue);
|
||||
CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body md5");
|
||||
bod->md5 = cpystr(Z_STRVAL_P(pvalue));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
--TEST--
|
||||
Bug #80710 (imap_mail_compose() header injection) - MIME Splitting Attack
|
||||
--SKIPIF--
|
||||
<?php
|
||||
if (!extension_loaded("imap")) die("skip imap extension not available");
|
||||
?>
|
||||
--FILE--
|
||||
<?php
|
||||
$envelope["from"]= "joe@example.com\n From : X-INJECTED";
|
||||
$envelope["to"] = "foo@example.com\nFrom: X-INJECTED";
|
||||
$envelope["cc"] = "bar@example.com\nFrom: X-INJECTED";
|
||||
$envelope["subject"] = "bar@example.com\n\n From : X-INJECTED";
|
||||
$envelope["x-remail"] = "bar@example.com\nFrom: X-INJECTED";
|
||||
$envelope["something"] = "bar@example.com\nFrom: X-INJECTED";
|
||||
|
||||
$part1["type"] = TYPEMULTIPART;
|
||||
$part1["subtype"] = "mixed";
|
||||
|
||||
$part2["type"] = TYPEAPPLICATION;
|
||||
$part2["encoding"] = ENCBINARY;
|
||||
$part2["subtype"] = "octet-stream\nContent-Type: X-INJECTED";
|
||||
$part2["description"] = "some file\nContent-Type: X-INJECTED";
|
||||
$part2["contents.data"] = "ABC\nContent-Type: X-INJECTED";
|
||||
|
||||
$part3["type"] = TYPETEXT;
|
||||
$part3["subtype"] = "plain";
|
||||
$part3["description"] = "description3";
|
||||
$part3["contents.data"] = "contents.data3\n\n\n\t";
|
||||
|
||||
$body[1] = $part1;
|
||||
$body[2] = $part2;
|
||||
$body[3] = $part3;
|
||||
|
||||
echo imap_mail_compose($envelope, $body);
|
||||
?>
|
||||
--EXPECTF--
|
||||
Warning: imap_mail_compose(): header injection attempt in from in %s on line %d
|
||||
@@ -1,37 +0,0 @@
|
||||
--TEST--
|
||||
Bug #80710 (imap_mail_compose() header injection) - Remail
|
||||
--SKIPIF--
|
||||
<?php
|
||||
if (!extension_loaded("imap")) die("skip imap extension not available");
|
||||
?>
|
||||
--FILE--
|
||||
<?php
|
||||
$envelope["from"]= "joe@example.com\n From : X-INJECTED";
|
||||
$envelope["to"] = "foo@example.com\nFrom: X-INJECTED";
|
||||
$envelope["cc"] = "bar@example.com\nFrom: X-INJECTED";
|
||||
$envelope["subject"] = "bar@example.com\n\n From : X-INJECTED";
|
||||
$envelope["remail"] = "X-INJECTED-REMAIL: X-INJECTED\nFrom: X-INJECTED-REMAIL-FROM"; //<--- Injected as first hdr
|
||||
$envelope["something"] = "bar@example.com\nFrom: X-INJECTED";
|
||||
|
||||
$part1["type"] = TYPEMULTIPART;
|
||||
$part1["subtype"] = "mixed";
|
||||
|
||||
$part2["type"] = TYPEAPPLICATION;
|
||||
$part2["encoding"] = ENCBINARY;
|
||||
$part2["subtype"] = "octet-stream\nContent-Type: X-INJECTED";
|
||||
$part2["description"] = "some file\nContent-Type: X-INJECTED";
|
||||
$part2["contents.data"] = "ABC\nContent-Type: X-INJECTED";
|
||||
|
||||
$part3["type"] = TYPETEXT;
|
||||
$part3["subtype"] = "plain";
|
||||
$part3["description"] = "description3";
|
||||
$part3["contents.data"] = "contents.data3\n\n\n\t";
|
||||
|
||||
$body[1] = $part1;
|
||||
$body[2] = $part2;
|
||||
$body[3] = $part3;
|
||||
|
||||
echo imap_mail_compose($envelope, $body);
|
||||
?>
|
||||
--EXPECTF--
|
||||
Warning: imap_mail_compose(): header injection attempt in remail in %s on line %d
|
||||
+2
-2
@@ -3,6 +3,6 @@
|
||||
#define PHP_MAJOR_VERSION 7
|
||||
#define PHP_MINOR_VERSION 4
|
||||
#define PHP_RELEASE_VERSION 18
|
||||
#define PHP_EXTRA_VERSION ""
|
||||
#define PHP_VERSION "7.4.18"
|
||||
#define PHP_EXTRA_VERSION "RC1"
|
||||
#define PHP_VERSION "7.4.18RC1"
|
||||
#define PHP_VERSION_ID 70418
|
||||
Reference in new issue
Block a user