commit 2d5f609d0733785604d4447576edc11f3b39d08a Author: Ayesh Karunaratne Date: Thu Nov 26 00:15:23 2020 +0700 PHPMailer 6.2.0 diff --git a/src/wp-includes/PHPMailer/Exception.php b/src/wp-includes/PHPMailer/Exception.php index e7807fc2ca..a50a8991f7 100644 --- a/src/wp-includes/PHPMailer/Exception.php +++ b/src/wp-includes/PHPMailer/Exception.php @@ -1,4 +1,5 @@ host) && static::validateAddress( - $address->mailbox . '@' . $address->host - )) { + if ( + ('.SYNTAX-ERROR.' !== $address->host) && static::validateAddress( + $address->mailbox . '@' . $address->host + ) + ) { $addresses[] = [ 'name' => (property_exists($address, 'personal') ? $address->personal : ''), 'address' => $address->mailbox . '@' . $address->host, @@ -1241,7 +1244,8 @@ public function setFrom($address, $name = '', $auto = true) $name = trim(preg_replace('/[\r\n]+/', '', $name)); //Strip breaks and trim // Don't validate now addresses with IDN. Will be done in send(). $pos = strrpos($address, '@'); - if ((false === $pos) + if ( + (false === $pos) || ((!$this->has8bitChars(substr($address, ++$pos)) || !static::idnSupported()) && !static::validateAddress($address)) ) { @@ -1393,7 +1397,8 @@ public function punyencodeAddress($address) { // Verify we have required functions, CharSet, and at-sign. $pos = strrpos($address, '@'); - if (!empty($this->CharSet) && + if ( + !empty($this->CharSet) && false !== $pos && static::idnSupported() ) { @@ -1457,8 +1462,9 @@ public function send() */ public function preSend() { - if ('smtp' === $this->Mailer - || ('mail' === $this->Mailer && stripos(PHP_OS, 'WIN') === 0) + if ( + 'smtp' === $this->Mailer + || ('mail' === $this->Mailer && (PHP_VERSION_ID >= 80000 || stripos(PHP_OS, 'WIN') === 0)) ) { //SMTP mandates RFC-compliant line endings //and it's also used with mail() on Windows @@ -1468,7 +1474,8 @@ public function preSend() static::setLE(PHP_EOL); } //Check for buggy PHP versions that add a header with an incorrect line break - if ('mail' === $this->Mailer + if ( + 'mail' === $this->Mailer && ((PHP_VERSION_ID >= 70000 && PHP_VERSION_ID < 70017) || (PHP_VERSION_ID >= 70100 && PHP_VERSION_ID < 70103)) && ini_get('mail.add_x_header') === '1' @@ -1555,7 +1562,8 @@ public function preSend() } // Sign with DKIM if enabled - if (!empty($this->DKIM_domain) + if ( + !empty($this->DKIM_domain) && !empty($this->DKIM_selector) && (!empty($this->DKIM_private_string) || (!empty($this->DKIM_private) @@ -1613,7 +1621,7 @@ public function postSend() } } catch (Exception $exc) { if ($this->Mailer === 'smtp' && $this->SMTPKeepAlive == true) { - $this->smtp->reset(); + $this->smtp->reset(); } $this->setError($exc->getMessage()); $this->edebug($exc->getMessage()); @@ -1719,7 +1727,8 @@ protected function sendmailSend($header, $body) protected static function isShellSafe($string) { // Future-proof - if (escapeshellcmd($string) !== $string + if ( + escapeshellcmd($string) !== $string || !in_array(escapeshellarg($string), ["'$string'", "\"$string\""]) ) { return false; @@ -1903,7 +1912,7 @@ protected function smtpSend($header, $body) $isSent = true; } - $callbacks[] = ['issent'=>$isSent, 'to'=>$to[0]]; + $callbacks[] = ['issent' => $isSent, 'to' => $to[0]]; } } @@ -1983,11 +1992,13 @@ public function smtpConnect($options = null) foreach ($hosts as $hostentry) { $hostinfo = []; - if (!preg_match( - '/^(?:(ssl|tls):\/\/)?(.+?)(?::(\d+))?$/', - trim($hostentry), - $hostinfo - )) { + if ( + !preg_match( + '/^(?:(ssl|tls):\/\/)?(.+?)(?::(\d+))?$/', + trim($hostentry), + $hostinfo + ) + ) { $this->edebug($this->lang('invalid_hostentry') . ' ' . trim($hostentry)); // Not a valid host entry continue; @@ -2056,12 +2067,14 @@ public function smtpConnect($options = null) // We must resend EHLO after TLS negotiation $this->smtp->hello($hello); } - if ($this->SMTPAuth && !$this->smtp->authenticate( - $this->Username, - $this->Password, - $this->AuthType, - $this->oauth - )) { + if ( + $this->SMTPAuth && !$this->smtp->authenticate( + $this->Username, + $this->Password, + $this->AuthType, + $this->oauth + ) + ) { throw new Exception($this->lang('authenticate')); } @@ -2119,7 +2132,7 @@ public function setLanguage($langcode = 'en', $lang_path = '') 'am' => 'hy', ]; - if (isset($renamed_langcodes[$langcode])) { + if (array_key_exists($langcode, $renamed_langcodes)) { $langcode = $renamed_langcodes[$langcode]; } @@ -2428,7 +2441,8 @@ public function createHeader() } // sendmail and mail() extract Bcc from the header before sending - if (( + if ( + ( 'sendmail' === $this->Mailer || 'qmail' === $this->Mailer || 'mail' === $this->Mailer ) && count($this->bcc) > 0 @@ -3898,7 +3912,8 @@ protected function serverHostname() public static function isValidHost($host) { //Simple syntax limits - if (empty($host) + if ( + empty($host) || !is_string($host) || strlen($host) > 256 || !preg_match('/^([a-zA-Z\d.-]*|\[[a-fA-F\d:]+])$/', $host) @@ -4064,7 +4079,8 @@ public function msgHTML($message, $basedir = '', $advanced = false) ); continue; } - if (// Only process relative URLs if a basedir is provided (i.e. no absolute local paths) + if ( + // Only process relative URLs if a basedir is provided (i.e. no absolute local paths) !empty($basedir) // Ignore URLs containing parent dir traversal (..) && (strpos($url, '..') === false) @@ -4086,13 +4102,14 @@ public function msgHTML($message, $basedir = '', $advanced = false) if (strlen($directory) > 1 && '/' !== substr($directory, -1)) { $directory .= '/'; } - if ($this->addEmbeddedImage( - $basedir . $directory . $filename, - $cid, - $filename, - static::ENCODING_BASE64, - static::_mime_types((string) static::mb_pathinfo($filename, PATHINFO_EXTENSION)) - ) + if ( + $this->addEmbeddedImage( + $basedir . $directory . $filename, + $cid, + $filename, + static::ENCODING_BASE64, + static::_mime_types((string) static::mb_pathinfo($filename, PATHINFO_EXTENSION)) + ) ) { $message = preg_replace( '/' . $images[1][$imgindex] . '=["\']' . preg_quote($url, '/') . '["\']/Ui', @@ -4511,11 +4528,15 @@ public function DKIM_Sign($signHeader) $privKey = openssl_pkey_get_private($privKeyStr); } if (openssl_sign($signHeader, $signature, $privKey, 'sha256WithRSAEncryption')) { - openssl_pkey_free($privKey); + if (PHP_MAJOR_VERSION < 8) { + openssl_pkey_free($privKey); + } return base64_encode($signature); } - openssl_pkey_free($privKey); + if (PHP_MAJOR_VERSION < 8) { + openssl_pkey_free($privKey); + } return ''; } diff --git a/src/wp-includes/PHPMailer/SMTP.php b/src/wp-includes/PHPMailer/SMTP.php index 9e43dce2a5..ab7f46e4c8 100644 --- a/src/wp-includes/PHPMailer/SMTP.php +++ b/src/wp-includes/PHPMailer/SMTP.php @@ -1,4 +1,5 @@ sendCommand( - 'User & Password', - base64_encode("\0" . $username . "\0" . $password), - 235 - ) + if ( + !$this->sendCommand( + 'User & Password', + base64_encode("\0" . $username . "\0" . $password), + 235 + ) ) { return false; } @@ -1086,8 +1088,10 @@ public function client_send($data, $command = '') { //If SMTP transcripts are left enabled, or debug output is posted online //it can leak credentials, so hide credentials in all but lowest level - if (self::DEBUG_LOWLEVEL > $this->do_debug && - in_array($command, ['User & Password', 'Username', 'Password'], true)) { + if ( + self::DEBUG_LOWLEVEL > $this->do_debug && + in_array($command, ['User & Password', 'Username', 'Password'], true) + ) { $this->edebug('CLIENT -> SERVER: [credentials hidden]', self::DEBUG_CLIENT); } else { $this->edebug('CLIENT -> SERVER: ' . $data, self::DEBUG_CLIENT); @@ -1207,7 +1211,8 @@ protected function get_lines() self::DEBUG_LOWLEVEL ); - //stream_select returns false when the `select` system call is interrupted by an incoming signal, try the select again + //stream_select returns false when the `select` system call is interrupted + //by an incoming signal, try the select again if (stripos($message, 'interrupted system call') !== false) { $this->edebug( 'SMTP -> get_lines(): retrying stream_select',