Re: Bug 16200

2009/5/8 Daniel O'Connor <daniel.oconnor@gmail.com>: > http://pear.php.net/bugs/bug.php?id=16200 > > Can someone with more experience with both sendmail and PEAR::Mail take a > look at this, and the patch / come up with a better one please? > That is an important bug indeed, however, I am not in favor of adding a new dependency for a largely used package as such as this one. What I recommend is that we use escapeshellarg on the arguments (From, To, Cc, etc). This will cover the security bug. However we should recommend that the users validate the email address prior to sending emails. This it not Secure_Mail and is simply a wrapper around many mail methods. I do agree that there's a vulnerability though and I'm going to make a very quick commit right now, Richard, Chuck, feel free to rollback and if you like it, please roll a release of Mail asap. Cheers, -- Slan, David