Edit report at https://bugs.php.net/bug.php?id=68776&edit=1
ID: 68776
Comment by: real dot rongginn at gmail dot com
Reported by: yohgaki@php.net
Summary: mail() does not have mail header injection
prevention for additional headers
Status: Closed
Type: Bug
Package: Mail related
Operating System: any
PHP Version: Irrelevant
Assigned To: yohgaki
Block user comment: N
Private report: N
New Comment:
hello
Previous Comments:
------------------------------------------------------------------------
[2018-08-14 05:25:15] calltrichymap at gmail dot com
hai , this is test message
------------------------------------------------------------------------
[2018-03-13 16:47:04] cmb@php.net
Related To: Bug #44187
------------------------------------------------------------------------
[2015-09-02 13:18:50] merijn at web2all dot nl
@yohgaki
regarding your last comment @chaos;
The documentation states 'String to be inserted at the end of the email header' and it
could (and has) been used to send a MIME message.
So this injection prevention fix breaks code which worked for over 10 years. And its also in a
pretty important part, the sending of mail.
I think this should not be fixed in minor release without any mention of a serious backwards
compatibility break....
------------------------------------------------------------------------
[2015-06-25 04:24:56] yohgaki@php.net
@chaos
To send multipart MIME message, users should use header and body correctly. RFC 2822 defines
CRLF+CRLF as start of body. So if users are misusing $additional_headers, they have to fix their
code.
------------------------------------------------------------------------
[2015-06-25 04:21:52] yohgaki@php.net
@chaos
We are planning to eliminate injection by this
https://bugs.php.net/bug.php?id=69791
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=68776
--
Edit this bug report at https://bugs.php.net/bug.php?id=68776&edit=1