#37109 [Opn]: imap_header - malicious processing of multiple 'from'-headers

ID: 37109 User updated by: oliver dot block at lycos dot de Reported By: oliver dot block at lycos dot de Status: Open Bug Type: IMAP related Operating System: Unix PHP Version: 5.1.2 New Comment: imap_rfc822_parse_headers does deliver the correct _from_ field. Previous Comments: ------------------------------------------------------------------------ [2006-04-17 17:43:19] oliver dot block at lycos dot de Description: ------------ When someone send mail with multiple from-header containing mulitple mailboxes, for example: From: name1 <mbox1@hotmail.com>, name2 <mbox2@yahoo.com>, name3 <mbox3@web.de> the function imap_header() (maybe others too) should keep this edresses in the from-field. Unfortunately the imap_function does not keep this data in the from-field, but in the _sender_ field. The same is applicable to fromaddress and senderaddress fields! Reproduce code: --------------- <?php $stream = imap_open($server,$username,$password); $header = imap_header($stream, $msgno); // $msgno is a valid message no to a message with multiple mailboxes in 'From:' header field print "<html><head><head><body><pre>"; print_r($header); print "</pre></body></html>"; imap_close($stream); ?> Expected result: ---------------- [from] => Array [0] => stdClass Object ( [personal] => name1 [mailbox] => mbox1 [host] => hotmail.com ) [1] => stdClass Object ( [personal] => name2 [mailbox] => mbox2 [host] => yahoo.com ) [2] => stdClass Object ( [personal] => name3 [mailbox] => mbox3 [host] => web.de ) Actual result: -------------- [sender] => Array [0] => stdClass Object ( [personal] => name1 [mailbox] => mbox1 [host] => hotmail.com ) [1] => stdClass Object ( [personal] => name2 [mailbox] => mbox2 [host] => yahoo.com ) [2] => stdClass Object ( [personal] => name3 [mailbox] => mbox3 [host] => web.de ) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=37109&edit=1