|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2009-06-20 17:49 UTC] shahar dot e at zend dot com
Description: ------------ It is very possible for a developer to use code like in the attached reproduction code to send an e-mail. However, when mail.add_x_header is On, using this code will cause the X-PHP-Originating-Script to show in the message body instead of as a header. This is because mail() assumes the $headers parameter is a string which does not end with a trailing CRLF - while in practice it very well may be (it works well when mail.add_x_header is Off). Reproduce code: --------------- <?php $headers = array( 'X-Foo' => 'bar', 'From' => '[email protected]', 'Priority' => 'Urgent' ); $hdrStr = ''; foreach($headers as $k => $v) { $hdrStr .= "$k: $v\r\n"; } mail('[email protected]', 'Testing add_x_header', 'This is a test', $hdrStr); Expected result: ---------------- Mail to look like: To: [email protected] Subject: Testing add_x_header X-Foo: bar From: [email protected] Priority: Urgent Date: Sat, 20 Jun 2009 20:37:34 +0300 (IDT) X-PHP-Originating-Script: 503:mailtest.php This is a test Actual result: -------------- To: [email protected] Subject: Testing add_x_header X-Foo: bar From: [email protected] Priority: Urgent Date: Sat, 20 Jun 2009 20:37:34 +0300 (IDT) X-PHP-Originating-Script: 503:mailtest.php This is a test * this is how I receive the e-mail in GMail - perhaps there is some header mangling but you get the point PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Dec 08 08:00:01 2025 UTC |
I used this patch to fix it (not sure if it's the most suitable way): --- ext/standard/mail.c.orig 2009-06-20 22:25:10.000000000 +0300 +++ ext/standard/mail.c 2009-06-20 22:29:52.000000000 +0300 @@ -241,7 +241,10 @@ php_basename(tmp, strlen(tmp), NULL, 0,&f, &f_len TSRMLS_CC); if (headers != NULL) { - spprintf(&hdr, 0, "%s\r\nX-PHP-Originating-Script: %ld:%s\n", headers, php_getuid(), f); + spprintf(&hdr, 0, "%s%sX-PHP-Originating-Script: %ld:%s\n", + headers, + (headers[strlen(headers) - 1] == '\n' ? "" : "\r\n"), + php_getuid(), f); } else { spprintf(&hdr, 0, "X-PHP-Originating-Script: %ld:%s\n", php_getuid(), f); }