#15509 [Com]: fifth argument in mail only supports one parameter and no spaces

ID: 15509 Comment by: pgb@qbfox.com Reported By: andreia.mahler@ipayx.com Status: Closed Bug Type: Mail related Operating System: Linux RedHat 7.1 PHP Version: 4.1.1 New Comment: I think the security issue of the fifth parameter is a red herring, as the parameter will rarely ("never") contain anything not explicitly written by the programmer. That is, it will "never" contain arbitrary web page input. I need to do "-odd -fadmin@shavashava.com", which, with the current restriction, means that I have to write my own mail() function, which shouldn't really be necessary for something like this ("odd" sets deferred delivery, dumping mail in the queue for the daemon to pick up later). I have in fact made a (very clean) patch against PHP-4.2.3 ext/mail.c to allow multiple params, I'll be happy to pass it on. -- Per Previous Comments: ------------------------------------------------------------------------ [2002-08-17 20:17:13] derick@php.net mail ('foo','bar','derick@example.com','',';killall -9 httpd'); (of course this will only kill httpd's running as the httpd user) Derick ------------------------------------------------------------------------ [2002-08-17 17:08:57] php@paul-roberts.com what are the security issues involved in passing multiple parameters. ------------------------------------------------------------------------ [2002-06-10 11:25:06] mfischer@php.net The behaviour was changed for security reason, only one parameter can be passed, even when spaces are in the parameter. ------------------------------------------------------------------------ [2002-06-10 10:30:34] andreia.mahler@ipayx.com I don't have safe-mode enabled - in php.ini ; ; Safe Mode ; safe_mode = Off Thanks! Andreia ------------------------------------------------------------------------ [2002-06-02 18:26:17] mfischer@php.net Do you have safe_mode enabled? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/15509 -- Edit this bug report at http://bugs.php.net/?id=15509&edit=1