Skip to content
This repository was archived by the owner on Oct 2, 2019. It is now read-only.

Commit 57a60da

Browse files
author
cspruiell
committed
MAGETWO-63632: [Backport] - Fix Zend Mail vulnerability - part 2 - for 2.1
- fix vulnerability
1 parent 6a4cbd2 commit 57a60da

File tree

1 file changed

+8
-35
lines changed

1 file changed

+8
-35
lines changed

library/Zend/Mail/Transport/Sendmail.php

Lines changed: 8 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ class Zend_Mail_Transport_Sendmail extends Zend_Mail_Transport_Abstract
4545
*/
4646
public $subject = null;
4747

48-
4948
/**
5049
* Config options for sendmail parameters
5150
*
@@ -85,7 +84,6 @@ public function __construct($parameters = null)
8584
$this->parameters = $parameters;
8685
}
8786

88-
8987
/**
9088
* Send mail using PHP native mail()
9189
*
@@ -97,37 +95,13 @@ public function __construct($parameters = null)
9795
*/
9896
public function _sendMail()
9997
{
100-
if ($this->parameters === null) {
101-
set_error_handler(array($this, '_handleMailErrors'));
102-
$result = mail(
103-
$this->recipients,
104-
$this->_mail->getSubject(),
105-
$this->body,
106-
$this->header);
107-
restore_error_handler();
108-
} else {
109-
if(!is_string($this->parameters)) {
110-
/**
111-
* @see Zend_Mail_Transport_Exception
112-
*
113-
* Exception is thrown here because
114-
* $parameters is a public property
115-
*/
116-
#require_once 'Zend/Mail/Transport/Exception.php';
117-
throw new Zend_Mail_Transport_Exception(
118-
'Parameters were set but are not a string'
119-
);
120-
}
121-
122-
set_error_handler(array($this, '_handleMailErrors'));
123-
$result = mail(
124-
$this->recipients,
125-
$this->_mail->getSubject(),
126-
$this->body,
127-
$this->header,
128-
$this->parameters);
129-
restore_error_handler();
130-
}
98+
set_error_handler(array($this, '_handleMailErrors'));
99+
$result = mail(
100+
$this->recipients,
101+
$this->_mail->getSubject(),
102+
$this->body,
103+
$this->header);
104+
restore_error_handler();
131105

132106
if ($this->_errstr !== null || !$result) {
133107
/**
@@ -138,7 +112,6 @@ public function _sendMail()
138112
}
139113
}
140114

141-
142115
/**
143116
* Format and fix headers
144117
*
@@ -196,7 +169,7 @@ protected function _prepareHeaders($headers)
196169

197170
// Sanitize the From header
198171
if (isset($headers['From'])) {
199-
$addressList = array_filter($headers['From'], function($key) {
172+
$addressList = array_filter($headers['From'], function ($key) {
200173
return $key !== 'append';
201174
}, ARRAY_FILTER_USE_KEY);
202175
foreach ($addressList as $address) {

0 commit comments

Comments
 (0)