Brian Wolff has uploaded a new change for review. (
https://gerrit.wikimedia.org/r/326260 )
Change subject: Escape return path extra params to php mail()
......................................................................
Escape return path extra params to php mail()
PHP only escapes some dangerous shell characters. This is a hardening
measure, as MW's sanitizeEmail routines should also have prevented
evil characters from being in mail addresses in the first place.
Bug: T152717
Change-Id: I3736d612ed40d257ee3dde8e98eb30ccf432670a
---
M includes/mail/UserMailer.php
1 file changed, 8 insertions(+), 1 deletion(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core
refs/changes/60/326260/1
diff --git a/includes/mail/UserMailer.php b/includes/mail/UserMailer.php
index c8e9999..21effa0 100644
--- a/includes/mail/UserMailer.php
+++ b/includes/mail/UserMailer.php
@@ -268,7 +268,14 @@
// Add the envelope sender address using the -f command line
option when PHP mail() is used.
// Will default to the $from->address when the
UserMailerChangeReturnPath hook fails and the
// generated VERP address when the hook runs effectively.
- $extraParams .= ' -f ' . $returnPath;
+
+ // PHP runs this through escapeshellcmd(). However that's not
sufficient
+ // escaping (e.g. due to spaces). MediaWiki's email sanitizer
should generally
+ // be good enough, but just in case, put in double quotes, and
remove any
+ // double quotes present (" is not allowed in emails, so should
have no
+ // effect, although this might cause apostrophees to be double
escaped)
+ $returnPathCLI = '"' . str_replace( '"', '', $returnPath ) .
'"';
+ $extraParams .= ' -f ' . $returnPathCLI;
$headers['Return-Path'] = $returnPath;
--
To view, visit https://gerrit.wikimedia.org/r/326260
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I3736d612ed40d257ee3dde8e98eb30ccf432670a
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: master
Gerrit-Owner: Brian Wolff <bawolff...@gmail.com>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
