mirror
/
PHPMailer
mirror of https://github.com/PHPMailer/PHPMailer.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3283 from SirLouen/patch/3282 

Fixing troubles with mailSend and Sender enabled
This commit is contained in:
Marcus Bointon 2026-01-09 17:34:10 +00:00 committed by GitHub
parent 7e3f24386f 0d4c5ee8da
commit b938991866
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 231 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

95
src/PHPMailer.php
View File

@ -988,6 +988,54 @@ class PHPMailer
$this->Mailer = 'mail';
}
/**
* Extract sendmail path and parse to deal with known parameters.
*
* @param string $sendmailPath The sendmail path as set in php.ini
*
* @return string The sendmail path without the known parameters
*/
private function parseSendmailPath($sendmailPath)
{
$sendmailPath = trim((string)$sendmailPath);
if ($sendmailPath === '') {
return $sendmailPath;
}
$parts = preg_split('/\s+/', $sendmailPath);
if (empty($parts)) {
return $sendmailPath;
}
$command = array_shift($parts);
$remainder = [];
// Parse only -t, -i, -oi and -f parameters.
for ($i = 0; $i < count($parts); ++$i) {
$part = $parts[$i];
if (preg_match('/^-(i|oi|t)$/', $part, $matches)) {
continue;
}
if (preg_match('/^-f(.*)$/', $part, $matches)) {
$address = $matches[1];
if ($address === '' && isset($parts[$i + 1]) && strpos($parts[$i + 1], '-') !== 0) {
$address = $parts[++$i];
}
$this->Sender = $address;
continue;
}
$remainder[] = $part;
}
// The params that are not parsed are added back to the command.
if (!empty($remainder)) {
$command .= ' ' . implode(' ', $remainder);
}
return $command;
}
/**
* Send messages using $Sendmail.
*/
@ -996,10 +1044,9 @@ class PHPMailer
$ini_sendmail_path = ini_get('sendmail_path');
if (false === stripos($ini_sendmail_path, 'sendmail')) {
$this->Sendmail = '/usr/sbin/sendmail';
} else {
$this->Sendmail = $ini_sendmail_path;
$ini_sendmail_path = '/usr/sbin/sendmail';
}
$this->Sendmail = $this->parseSendmailPath($ini_sendmail_path);
$this->Mailer = 'sendmail';
}
@ -1011,10 +1058,9 @@ class PHPMailer
$ini_sendmail_path = ini_get('sendmail_path');
if (false === stripos($ini_sendmail_path, 'qmail')) {
$this->Sendmail = '/var/qmail/bin/qmail-inject';
} else {
$this->Sendmail = $ini_sendmail_path;
$ini_sendmail_path = '/var/qmail/bin/qmail-inject';
}
$this->Sendmail = $this->parseSendmailPath($ini_sendmail_path);
$this->Mailer = 'qmail';
}
@ -1860,25 +1906,27 @@ class PHPMailer
//PHP config has a sender address we can use
$this->Sender = ini_get('sendmail_from');
}
//CVE-2016-10033, CVE-2016-10045: Don't pass -f if characters will be escaped.
$sendmailArgs = [];
// CVE-2016-10033, CVE-2016-10045: Don't pass -f if characters will be escaped.
// Also don't add the -f automatically unless it has been set either via Sender
// or sendmail_path. Otherwise it can introduce new problems.
// @see http://github.com/PHPMailer/PHPMailer/issues/2298
if (!empty($this->Sender) && static::validateAddress($this->Sender) && self::isShellSafe($this->Sender)) {
if ($this->Mailer === 'qmail') {
$sendmailFmt = '%s -f%s';
} else {
$sendmailFmt = '%s -oi -f%s -t';
}
} elseif ($this->Mailer === 'qmail') {
$sendmailFmt = '%s';
} else {
//Allow sendmail to choose a default envelope sender. It may
//seem preferable to force it to use the From header as with
//SMTP, but that introduces new problems (see
//<https://github.com/PHPMailer/PHPMailer/issues/2298>), and
//it has historically worked this way.
$sendmailFmt = '%s -oi -t';
$sendmailArgs[] = '-f' . $this->Sender;
}
$sendmail = sprintf($sendmailFmt, escapeshellcmd($this->Sendmail), $this->Sender);
// Qmail doesn't accept all the sendmail parameters
// @see https://github.com/PHPMailer/PHPMailer/issues/3189
if ($this->Mailer !== 'qmail') {
$sendmailArgs[] = '-i';
$sendmailArgs[] = '-t';
}
$resultArgs = (empty($sendmailArgs) ? '' : ' ' . implode(' ', $sendmailArgs));
$sendmail = trim(escapeshellcmd($this->Sendmail) . $resultArgs);
$this->edebug('Sendmail path: ' . $this->Sendmail);
$this->edebug('Sendmail command: ' . $sendmail);
$this->edebug('Envelope sender: ' . $this->Sender);
@ -2062,7 +2110,8 @@ class PHPMailer
$this->Sender = ini_get('sendmail_from');
}
if (!empty($this->Sender) && static::validateAddress($this->Sender)) {
if (self::isShellSafe($this->Sender)) {
$phpmailer_path = ini_get('sendmail_path');
if (self::isShellSafe($this->Sender) && strpos($phpmailer_path, ' -f') === false) {
$params = sprintf('-f%s', $this->Sender);
}
$old_from = ini_get('sendmail_from');

165
test/PHPMailer/MailTransportTest.php
View File

@ -20,6 +20,23 @@ use PHPMailer\Test\SendTestCase;
*/
final class MailTransportTest extends SendTestCase
{
/** @var string */
private $originalSendmailFrom = '';
protected function set_up()
{
parent::set_up();
$from = ini_get('sendmail_from');
$this->originalSendmailFrom = $from === false ? '' : $from;
}
protected function tear_down()
{
ini_set('sendmail_from', $this->originalSendmailFrom);
parent::tear_down();
}
/**
* Test sending using SendMail.
*
@ -65,12 +82,6 @@ final class MailTransportTest extends SendTestCase
*/
public function testMailSend()
{
$sendmail = ini_get('sendmail_path');
// No path in sendmail_path.
if (strpos($sendmail, '/') === false) {
ini_set('sendmail_path', '/usr/sbin/sendmail -t -i ');
}
$this->Mail->Body = 'Sending via mail()';
$this->buildBody();
$this->Mail->Subject = $this->Mail->Subject . ': mail()';
@ -105,4 +116,146 @@ final class MailTransportTest extends SendTestCase
$msg = $this->Mail->getSentMIMEMessage();
self::assertStringNotContainsString("\r\n\r\nMIME-Version:", $msg, 'Incorrect MIME headers');
}
/**
* Test sending using PHP mail() function with Sender address
* and explicit sendmail_from ini set.
* Test running required with:
* php -d sendmail_path="/usr/sbin/sendmail -t -i -frpath@example.org" ./vendor/bin/phpunit
*
* @group sendmailparams
* @covers \PHPMailer\PHPMailer\PHPMailer::isMail
*/
public function testMailSendWithSendmailParams()
{
$sender = 'rpath@example.org';
if (strpos(ini_get('sendmail_path'), $sender) === false) {
self::markTestSkipped('Custom Sendmail php.ini not available');
}
$this->Mail->Body = 'Sending via mail()';
$this->buildBody();
$this->Mail->Subject = $this->Mail->Subject . ': mail()';
$this->Mail->clearAddresses();
$this->setAddress('testmailsend@example.com', 'totest');
ini_set('sendmail_from', $sender);
$this->Mail->createHeader();
$this->Mail->isMail();
self::assertTrue($this->Mail->send(), $this->Mail->ErrorInfo);
}
/**
* Test sending using SendMail with Sender address
* and explicit sendmail_from ini set.
* Test running required with:
* php -d sendmail_path="/usr/sbin/sendmail -t -i -frpath@example.org" ./vendor/bin/phpunit
*
* @group sendmailparams
* @covers \PHPMailer\PHPMailer\PHPMailer::isSendmail
*/
public function testSendmailSendWithSendmailParams()
{
$sender = 'rpath@example.org';
if (strpos(ini_get('sendmail_path'), $sender) === false) {
self::markTestSkipped('Custom Sendmail php.ini not available');
}
$this->Mail->Body = 'Sending via sendmail';
$this->buildBody();
$subject = $this->Mail->Subject;
$this->Mail->Subject = $subject . ': sendmail';
ini_set('sendmail_from', $sender);
$this->Mail->isSendmail();
self::assertTrue($this->Mail->send(), $this->Mail->ErrorInfo);
}
/**
* Test parsing of sendmail path and with certain parameters.
*
* @group sendmailparams
* @covers \PHPMailer\PHPMailer\PHPMailer::parseSendmailPath
* @dataProvider sendmailPathProvider
*
* @param string $sendmailPath The sendmail path to parse.
* @param string $expectedCommand The expected command after parsing.
* @param string $expectedSender The expected Sender (-f parameter) after parsing.
*/
public function testParseSendmailPath($sendmailPath, $expectedCommand, $expectedSender)
{
$mailer = $this->Mail;
$parseSendmailPath = \Closure::bind(
function ($path) {
return $this->{'parseSendmailPath'}($path);
},
$mailer,
\PHPMailer\PHPMailer\PHPMailer::class
);
$command = $parseSendmailPath($sendmailPath);
self::assertSame($expectedCommand, $command, 'Sendmail command not parsed correctly');
self::assertSame($expectedSender, $mailer->Sender, 'Sender property not set correctly');
}
/**
* Data provider for testParseSendmailPath.
*
* @return array{
* 0: string, // The sendmail path to parse.
* 1: string, // The expected command after parsing.
* 2: string // The expected Sender (-f parameter) after parsing.
* }
*/
public function sendmailPathProvider()
{
return [
'path only' => [
'/usr/sbin/sendmail',
'/usr/sbin/sendmail',
''
],
'with i and t' => [
'/usr/sbin/sendmail -i -t',
'/usr/sbin/sendmail',
''
],
'with f concatenated' => [
'/usr/sbin/sendmail -frpath@example.org -i',
'/usr/sbin/sendmail',
'rpath@example.org'
],
'with f separated' => [
'/usr/sbin/sendmail -f rpath@example.org -t',
'/usr/sbin/sendmail',
'rpath@example.org',
],
'with extra flags preserved' => [
'/opt/sendmail -x -y -fuser@example.org',
'/opt/sendmail -x -y',
'user@example.org',
],
"extra flags with values preserved" => [
'/opt/sendmail -X /path/to/logfile -fuser@example.org',
'/opt/sendmail -X /path/to/logfile',
'user@example.org',
],
"extra flags concatenated preserved" => [
'/opt/sendmail -X/path/to/logfile -t -i',
'/opt/sendmail -X/path/to/logfile',
'',
],
"option values with regular parameters" => [
'/opt/sendmail -oi -t',
'/opt/sendmail',
'',
],
];
}
}