Brian Wolff has uploaded a new change for review. (
https://gerrit.wikimedia.org/r/331670 )
Change subject: Escape return path extra params to php mail()
......................................................................
Escape return path extra params to php mail()
PHP only escapes some dangerous shell characters. This is a hardening
measure, as MW's sanitizeEmail routines should also have prevented
evil characters from being in mail addresses in the first place.
Bug: T152717
Change-Id: I3736d612ed40d257ee3dde8e98eb30ccf432670a
---
M RELEASE-NOTES-1.27
M includes/mail/UserMailer.php
2 files changed, 9 insertions(+), 1 deletion(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core
refs/changes/70/331670/1
diff --git a/RELEASE-NOTES-1.27 b/RELEASE-NOTES-1.27
index 770abc7..94b7142 100644
--- a/RELEASE-NOTES-1.27
+++ b/RELEASE-NOTES-1.27
@@ -7,6 +7,7 @@
in inline styles.
* $wgRunJobsAsync is now false by default (T142751). This change only affects
wikis with $wgJobRunRate > 0.
+* (T152717) Better escaping for PHP mail() command
== MediaWiki 1.27.1 ==
diff --git a/includes/mail/UserMailer.php b/includes/mail/UserMailer.php
index 1059d7b..f3361fb 100644
--- a/includes/mail/UserMailer.php
+++ b/includes/mail/UserMailer.php
@@ -268,7 +268,14 @@
// Add the envelope sender address using the -f command line
option when PHP mail() is used.
// Will default to the $from->address when the
UserMailerChangeReturnPath hook fails and the
// generated VERP address when the hook runs effectively.
- $extraParams .= ' -f ' . $returnPath;
+
+ // PHP runs this through escapeshellcmd(). However that's not
sufficient
+ // escaping (e.g. due to spaces). MediaWiki's email sanitizer
should generally
+ // be good enough, but just in case, put in double quotes, and
remove any
+ // double quotes present (" is not allowed in emails, so should
have no
+ // effect, although this might cause apostrophees to be double
escaped)
+ $returnPathCLI = '"' . str_replace( '"', '', $returnPath ) .
'"';
+ $extraParams .= ' -f ' . $returnPathCLI;
$headers['Return-Path'] = $returnPath;
--
To view, visit https://gerrit.wikimedia.org/r/331670
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I3736d612ed40d257ee3dde8e98eb30ccf432670a
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: REL1_27
Gerrit-Owner: Brian Wolff <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
