+ * Do not source $message content from user input!
+ * $basedir is prepended when handling relative URLs, e.g. 
and must not be empty
* will look for an image file in $basedir/images/a.png and convert it to inline.
- * If you don't want to apply these transformations to your HTML, just set Body and AltBody yourself.
+ * If you don't provide a $basedir, relative paths will be left untouched (and thus probably break in email)
+ * If you don't want to apply these transformations to your HTML, just set Body and AltBody directly.
* @access public
* @param string $message HTML message string
- * @param string $basedir base directory for relative paths to images
+ * @param string $basedir Absolute path to a base directory to prepend to relative paths to images
* @param boolean|callable $advanced Whether to use the internal HTML to text converter
* or your own custom converter @see PHPMailer::html2text()
* @return string $message The transformed message Body
@@ -3352,6 +3398,10 @@ class PHPMailer
{
preg_match_all('/(src|background)=["\'](.*)["\']/Ui', $message, $images);
if (array_key_exists(2, $images)) {
+ if (strlen($basedir) > 1 && substr($basedir, -1) != '/') {
+ // Ensure $basedir has a trailing /
+ $basedir .= '/';
+ }
foreach ($images[2] as $imgindex => $url) {
// Convert data URIs into embedded images
if (preg_match('#^data:(image[^;,]*)(;base64)?,#', $url, $match)) {
@@ -3369,18 +3419,24 @@ class PHPMailer
$message
);
}
- } elseif (substr($url, 0, 4) !== 'cid:' && !preg_match('#^[a-z][a-z0-9+.-]*://#i', $url)) {
- // Do not change urls for absolute images (thanks to corvuscorax)
+ continue;
+ }
+ if (
+ // Only process relative URLs if a basedir is provided (i.e. no absolute local paths)
+ !empty($basedir)
+ // Ignore URLs containing parent dir traversal (..)
+ && (strpos($url, '..') === false)
// Do not change urls that are already inline images
+ && substr($url, 0, 4) !== 'cid:'
+ // Do not change absolute URLs, including anonymous protocol
+ && !preg_match('#^[a-z][a-z0-9+.-]*:?//#i', $url)
+ ) {
$filename = basename($url);
$directory = dirname($url);
if ($directory == '.') {
$directory = '';
}
$cid = md5($url) . '@phpmailer.0'; // RFC2392 S 2
- if (strlen($basedir) > 1 && substr($basedir, -1) != '/') {
- $basedir .= '/';
- }
if (strlen($directory) > 1 && substr($directory, -1) != '/') {
$directory .= '/';
}
diff --git a/plugin/PHPMailer/class.pop3.php b/plugin/PHPMailer/class.pop3.php
index 32d614b35..f10e688e3 100644
--- a/plugin/PHPMailer/class.pop3.php
+++ b/plugin/PHPMailer/class.pop3.php
@@ -34,7 +34,7 @@ class POP3
* @var string
* @access public
*/
- public $Version = '5.2.19';
+ public $Version = '5.2.22';
/**
* Default POP3 port number.
diff --git a/plugin/PHPMailer/class.smtp.php b/plugin/PHPMailer/class.smtp.php
index 04ced6581..89321171b 100644
--- a/plugin/PHPMailer/class.smtp.php
+++ b/plugin/PHPMailer/class.smtp.php
@@ -30,7 +30,7 @@ class SMTP
* The PHPMailer SMTP version number.
* @var string
*/
- const VERSION = '5.2.19';
+ const VERSION = '5.2.22';
/**
* SMTP line break constant.
@@ -81,7 +81,7 @@ class SMTP
* @deprecated Use the `VERSION` constant instead
* @see SMTP::VERSION
*/
- public $Version = '5.2.19';
+ public $Version = '5.2.22';
/**
* SMTP server port number.
diff --git a/plugin/PHPMailer/examples/contactform.phps b/plugin/PHPMailer/examples/contactform.phps
new file mode 100644
index 000000000..d85e20456
--- /dev/null
+++ b/plugin/PHPMailer/examples/contactform.phps
@@ -0,0 +1,71 @@
+isSMTP();
+ $mail->Host = 'localhost';
+ $mail->Port = 25;
+
+ //Use a fixed address in your own domain as the from address
+ //**DO NOT** use the submitter's address here as it will be forgery
+ //and will cause your messages to fail SPF checks
+ $mail->setFrom('from@example.com', 'First Last');
+ //Send the message to yourself, or whoever should receive contact for submissions
+ $mail->addAddress('whoto@example.com', 'John Doe');
+ //Put the submitter's address in a reply-to header
+ //This will fail if the address provided is invalid,
+ //in which case we should ignore the whole request
+ if ($mail->addReplyTo($_POST['email'], $_POST['name'])) {
+ $mail->Subject = 'PHPMailer contact form';
+ //Keep it simple - don't use HTML
+ $mail->isHTML(false);
+ //Build a simple message body
+ $mail->Body = <<Russian text: Пустое тело сообщения
Armenian text: Հաղորդագրությունը դատարկ է
Czech text: Prázdné tělo zprávy
+Emoji: 😂 🦄 💥 📤 📧