Changeset 50848 for branches/5.6/src/wp-includes/PHPMailer/PHPMailer.php

Timestamp:

05/12/2021 10:24:16 PM (4 years ago)

Author:

peterwilsoncc

Message:

External libraries: Improve attachment handling in PHPMailer

Props: audrasjb, ayeshrajans, desrosj, peterwilsoncc, xknown.
Partially merges [50799] to the 5.6 branch.

Location:

branches/5.6

Files:

• . (modified) (1 prop)
• src/wp-includes/PHPMailer/PHPMailer.php (modified) (3 diffs)

branches/5.6/src/wp-includes/PHPMailer/PHPMailer.php

@@ -1762 +1762 @@
     protected static function isPermittedPath($path)
     {
-        return !preg_match('#^[a-z]+://#i', $path);
+        //Matches scheme definition from https://tools.ietf.org/html/rfc3986#section-3.1
+        return !preg_match('#^[a-z][a-z\d+.-]*://#i', $path);
     }
 
@@ -1774 +1775 @@
     protected static function fileIsAccessible($path)
     {
+        if (!static::isPermittedPath($path)) {
+            return false;
+        }
         $readable = file_exists($path);
         //If not a UNC path (expected to start with \\), check read permission, see #2069
@@ -1779 +1783 @@
             $readable = $readable && is_readable($path);
         }
-        return static::isPermittedPath($path) && $readable;
+        return $readable;
     }