apache - Error with PHP mail(): Multiple or malformed newlines found in additional_header -
suddenly have started receiving above error without changes having been made script.
host 1and1 (i know...)
the script still works fine on different server, , suspicion there must have been server config change has lead this, although hosts plead ignorance.
there's no information on above error @ in google can find - have ideas? server running apache if helps.
had similar problem.
came out of blue. no php code changed.
what changed: php upgraded 5.5.25-1 5.5.26.
a security risk in php mail()
function has been fixed , newlines in additional_headers
allowed no more. because newlines mean: starts email message (and surely don't want inject newlines through headers followed evil message).
what have worked fine, e.g. having newlines after headers or passing whole message additional_headers
, function no more.
solution:
- sanitize headers. no multiple newlines in
additional_headers
argument. these count "multiple or malformed newlines":\r\r, \r\0, \r\n\r\n, \n\n, \n\0
. - use
additional_headers
headers only. email message (multipart or not, ir without attachments, etc) belongs inmessage
argument, not in headers.
php security bug report: https://bugs.php.net/bug.php?id=68776
c code diff how fixed: http://git.php.net/?p=php-src.git;a=blobdiff;f=ext/standard/mail.c;h=448013a472a3466245e64b1cb37a9d1b0f7c007e;hp=1ebc8fecb7ef4c266a341cdc701f0686d6482242;hb=9d168b863e007c4e15ebe4d2eecabdf8b0582e30;hpb=eee8b6c33fc968ef8c496db8fb54e8c9d9d5a8f9
Comments
Post a Comment