Skip to content

Commit cd083f8

Browse files
bramleymarianaballa
bramley
authored and
marianaballa
committed
Update PHPMailer to version 6.4.1
1 parent ecc2a5d commit cd083f8

File tree

14 files changed

+492
-327
lines changed

14 files changed

+492
-327
lines changed

‎public_html/lists/admin/PHPMailer6/README.md‎

Lines changed: 68 additions & 67 deletions
Large diffs are not rendered by default.

‎public_html/lists/admin/PHPMailer6/SECURITY.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# Security notices relating to PHPMailer
22

3-
Please disclose any vulnerabilities found responsibly - report any security problems found to the maintainers privately.
3+
Please disclose any security issues or vulnerabilities found through [Tidelift's coordinated disclosure system](https://tidelift.com/security) or to the maintainers privately.
4+
5+
PHPMailer versions between 6.1.8 and 6.4.0 contain a regression of the earlier CVE-2018-19296 object injection vulnerability as a result of [a fix for Windows UNC paths in 6.1.8](https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9). Recorded as [CVE-2020-36326](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36326). Reported by Fariskhi Vidyan via Tidelift. 6.4.1 fixes this issue, and also enforces stricter checks for URL schemes in local path contexts.
46

57
PHPMailer versions 6.1.5 and earlier contain an output escaping bug that occurs in `Content-Type` and `Content-Disposition` when filenames passed into `addAttachment` and other methods that accept attachment names contain double quote characters, in contravention of RFC822 3.4.1. No specific vulnerability has been found relating to this, but it could allow file attachments to bypass attachment filters that are based on matching filename extensions. Recorded as [CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625). Reported by Elar Lang of Clarified Security.
68

‎public_html/lists/admin/PHPMailer6/VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
6.1.8
1+
6.4.1

‎public_html/lists/admin/PHPMailer6/composer.json‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,12 @@
3535
"dealerdirect/phpcodesniffer-composer-installer": "^0.7.0",
3636
"doctrine/annotations": "^1.2",
3737
"phpcompatibility/php-compatibility": "^9.3.5",
38-
"phpunit/phpunit": "^4.8 || ^5.7",
3938
"roave/security-advisories": "dev-latest",
40-
"squizlabs/php_codesniffer": "^3.5.6"
39+
"squizlabs/php_codesniffer": "^3.5.6",
40+
"yoast/phpunit-polyfills": "^0.2.0"
4141
},
4242
"suggest": {
43-
"ext-mbstring": "Needed to send email in multibyte encoding charset",
43+
"ext-mbstring": "Needed to send email in multibyte encoding charset or decode encoded addresses",
4444
"hayageek/oauth2-yahoo": "Needed for Yahoo XOAUTH2 authentication",
4545
"league/oauth2-google": "Needed for Google XOAUTH2 authentication",
4646
"psr/log": "For optional PSR-3 debug logging",
@@ -57,5 +57,9 @@
5757
"PHPMailer\\Test\\": "test/"
5858
}
5959
},
60-
"license": "LGPL-2.1-only"
60+
"license": "LGPL-2.1-only",
61+
"scripts": {
62+
"check": "./vendor/bin/phpcs",
63+
"test": "./vendor/bin/phpunit"
64+
}
6165
}

‎public_html/lists/admin/PHPMailer6/get_oauth_token.php‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -38,20 +38,20 @@
3838
* Plenty to choose from here:
3939
* @see http://oauth2-client.thephpleague.com/providers/thirdparty/
4040
*/
41-
// @see https://github.com/thephpleague/oauth2-google
41+
//@see https://github.com/thephpleague/oauth2-google
4242
use League\OAuth2\Client\Provider\Google;
43-
// @see https://packagist.org/packages/hayageek/oauth2-yahoo
43+
//@see https://packagist.org/packages/hayageek/oauth2-yahoo
4444
use Hayageek\OAuth2\Client\Provider\Yahoo;
45-
// @see https://github.com/stevenmaguire/oauth2-microsoft
45+
//@see https://github.com/stevenmaguire/oauth2-microsoft
4646
use Stevenmaguire\OAuth2\Client\Provider\Microsoft;
4747

4848
if (!isset($_GET['code']) && !isset($_GET['provider'])) {
4949
?>
5050
<html>
51-
<body>Select Provider:<br/>
52-
<a href='?provider=Google'>Google</a><br/>
53-
<a href='?provider=Yahoo'>Yahoo</a><br/>
54-
<a href='?provider=Microsoft'>Microsoft/Outlook/Hotmail/Live/Office365</a><br/>
51+
<body>Select Provider:<br>
52+
<a href='?provider=Google'>Google</a><br>
53+
<a href='?provider=Yahoo'>Yahoo</a><br>
54+
<a href='?provider=Microsoft'>Microsoft/Outlook/Hotmail/Live/Office365</a><br>
5555
</body>
5656
</html>
5757
<?php
@@ -121,26 +121,26 @@
121121
}
122122

123123
if (!isset($_GET['code'])) {
124-
// If we don't have an authorization code then get one
124+
//If we don't have an authorization code then get one
125125
$authUrl = $provider->getAuthorizationUrl($options);
126126
$_SESSION['oauth2state'] = $provider->getState();
127127
header('Location: ' . $authUrl);
128128
exit;
129-
// Check given state against previously stored one to mitigate CSRF attack
129+
//Check given state against previously stored one to mitigate CSRF attack
130130
} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
131131
unset($_SESSION['oauth2state']);
132132
unset($_SESSION['provider']);
133133
exit('Invalid state');
134134
} else {
135135
unset($_SESSION['provider']);
136-
// Try to get an access token (using the authorization code grant)
136+
//Try to get an access token (using the authorization code grant)
137137
$token = $provider->getAccessToken(
138138
'authorization_code',
139139
[
140140
'code' => $_GET['code']
141141
]
142142
);
143-
// Use this to interact with an API on the users behalf
144-
// Use this to get a new access token if the old one expires
143+
//Use this to interact with an API on the users behalf
144+
//Use this to get a new access token if the old one expires
145145
echo 'Refresh Token: ', $token->getRefreshToken();
146146
}

‎public_html/lists/admin/PHPMailer6/language/phpmailer.lang-cs.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616
$PHPMAILER_LANG['from_failed'] = 'Následující adresa odesílatele je nesprávná: ';
1717
$PHPMAILER_LANG['instantiate'] = 'Nelze vytvořit instanci emailové funkce.';
1818
$PHPMAILER_LANG['invalid_address'] = 'Neplatná adresa: ';
19+
$PHPMAILER_LANG['invalid_hostentry'] = 'Záznam hostitele je nesprávný: ';
20+
$PHPMAILER_LANG['invalid_host'] = 'Hostitel je nesprávný: ';
1921
$PHPMAILER_LANG['mailer_not_supported'] = ' mailer není podporován.';
2022
$PHPMAILER_LANG['provide_address'] = 'Musíte zadat alespoň jednu emailovou adresu příjemce.';
2123
$PHPMAILER_LANG['recipients_failed'] = 'Chyba SMTP: Následující adresy příjemců nejsou správně: ';

‎public_html/lists/admin/PHPMailer6/language/phpmailer.lang-sk.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
$PHPMAILER_LANG['from_failed'] = 'Následujúca adresa From je nesprávna: ';
1919
$PHPMAILER_LANG['instantiate'] = 'Nedá sa vytvoriť inštancia emailovej funkcie.';
2020
$PHPMAILER_LANG['invalid_address'] = 'Neodoslané, emailová adresa je nesprávna: ';
21+
$PHPMAILER_LANG['invalid_hostentry'] = 'Záznam hostiteľa je nesprávny: ';
22+
$PHPMAILER_LANG['invalid_host'] = 'Hostiteľ je nesprávny: ';
2123
$PHPMAILER_LANG['mailer_not_supported'] = ' emailový klient nieje podporovaný.';
2224
$PHPMAILER_LANG['provide_address'] = 'Musíte zadať aspoň jednu emailovú adresu príjemcu.';
2325
$PHPMAILER_LANG['recipients_failed'] = 'SMTP Error: Adresy príjemcov niesu správne ';

‎public_html/lists/admin/PHPMailer6/language/phpmailer.lang-sr_latn.php‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?php
2+
3+
/**
4+
* Serbian PHPMailer language file: refer to English translation for definitive list
5+
* @package PHPMailer
6+
* @author Александар Јевремовић <[email protected]>
7+
* @author Miloš Milanović <[email protected]>
8+
*/
9+
10+
$PHPMAILER_LANG['authenticate'] = 'SMTP greška: autentifikacija nije uspela.';
11+
$PHPMAILER_LANG['connect_host'] = 'SMTP greška: povezivanje sa SMTP serverom nije uspelo.';
12+
$PHPMAILER_LANG['data_not_accepted'] = 'SMTP greška: podaci nisu prihvaćeni.';
13+
$PHPMAILER_LANG['empty_message'] = 'Sadržaj poruke je prazan.';
14+
$PHPMAILER_LANG['encoding'] = 'Nepoznato kodiranje: ';
15+
$PHPMAILER_LANG['execute'] = 'Nije moguće izvršiti naredbu: ';
16+
$PHPMAILER_LANG['file_access'] = 'Nije moguće pristupiti datoteci: ';
17+
$PHPMAILER_LANG['file_open'] = 'Nije moguće otvoriti datoteku: ';
18+
$PHPMAILER_LANG['from_failed'] = 'SMTP greška: slanje sa sledećih adresa nije uspelo: ';
19+
$PHPMAILER_LANG['recipients_failed'] = 'SMTP greška: slanje na sledeće adrese nije uspelo: ';
20+
$PHPMAILER_LANG['instantiate'] = 'Nije moguće pokrenuti mail funkciju.';
21+
$PHPMAILER_LANG['invalid_address'] = 'Poruka nije poslata. Neispravna adresa: ';
22+
$PHPMAILER_LANG['mailer_not_supported'] = ' majler nije podržan.';
23+
$PHPMAILER_LANG['provide_address'] = 'Definišite bar jednu adresu primaoca.';
24+
$PHPMAILER_LANG['signing'] = 'Greška prilikom prijave: ';
25+
$PHPMAILER_LANG['smtp_connect_failed'] = 'Povezivanje sa SMTP serverom nije uspelo.';
26+
$PHPMAILER_LANG['smtp_error'] = 'Greška SMTP servera: ';
27+
$PHPMAILER_LANG['variable_set'] = 'Nije moguće zadati niti resetovati promenljivu: ';
28+
$PHPMAILER_LANG['extension_missing'] = 'Nedostaje proširenje: ';

‎public_html/lists/admin/PHPMailer6/language/phpmailer.lang-uk.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@
1616
$PHPMAILER_LANG['file_open'] = 'Помилка файлової системи: не вдається відкрити файл: ';
1717
$PHPMAILER_LANG['from_failed'] = 'Невірна адреса відправника: ';
1818
$PHPMAILER_LANG['instantiate'] = 'Неможливо запустити функцію mail().';
19-
$PHPMAILER_LANG['provide_address'] = 'Будь-ласка, введіть хоча б одну email-адресу отримувача.';
19+
$PHPMAILER_LANG['provide_address'] = 'Будь ласка, введіть хоча б одну email-адресу отримувача.';
2020
$PHPMAILER_LANG['mailer_not_supported'] = ' - поштовий сервер не підтримується.';
2121
$PHPMAILER_LANG['recipients_failed'] = 'Помилка SMTP: не вдалося відправлення для таких отримувачів: ';
2222
$PHPMAILER_LANG['empty_message'] = 'Пусте повідомлення';
23-
$PHPMAILER_LANG['invalid_address'] = 'Не відправлено через невірний формат email-адреси: ';
23+
$PHPMAILER_LANG['invalid_address'] = 'Не відправлено через неправильний формат email-адреси: ';
2424
$PHPMAILER_LANG['signing'] = 'Помилка підпису: ';
2525
$PHPMAILER_LANG['smtp_connect_failed'] = 'Помилка з\'єднання з SMTP-сервером';
2626
$PHPMAILER_LANG['smtp_error'] = 'Помилка SMTP-сервера: ';

‎public_html/lists/admin/PHPMailer6/phpunit.xml.dist‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<phpunit
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/8.5/phpunit.xsd"
5+
backupGlobals="true"
6+
bootstrap="vendor/autoload.php"
7+
verbose="true"
8+
colors="true"
9+
forceCoversAnnotation="false"
10+
>
11+
<testsuites>
12+
<testsuite name="PHPMailerTests">
13+
<directory>./test/</directory>
14+
</testsuite>
15+
</testsuites>
16+
<listeners>
17+
<listener class="PHPMailer\Test\DebugLogTestListener" />
18+
</listeners>
19+
<groups>
20+
<exclude>
21+
<group>languages</group>
22+
<group>pop3</group>
23+
</exclude>
24+
</groups>
25+
<filter>
26+
<whitelist addUncoveredFilesFromWhitelist="true">
27+
<directory suffix=".php">./src</directory>
28+
</whitelist>
29+
</filter>
30+
<logging>
31+
<log type="coverage-text" target="php://stdout" showUncoveredFiles="true"/>
32+
<log type="coverage-clover" target="build/logs/clover.xml"/>
33+
<log type="junit" target="build/logs/junit.xml"/>
34+
</logging>
35+
</phpunit>

0 commit comments

Comments
 (0)