Skip to content

Commit

Permalink
Dev: Update PHPMailer to 6.5.0
Browse files Browse the repository at this point in the history
  • Loading branch information
olleharstedt committed Jul 26, 2021
1 parent df909f9 commit c425c55
Show file tree
Hide file tree
Showing 58 changed files with 1,769 additions and 980 deletions.
147 changes: 78 additions & 69 deletions application/third_party/phpmailer/README.md

Large diffs are not rendered by default.

11 changes: 10 additions & 1 deletion application/third_party/phpmailer/SECURITY.md
@@ -1,6 +1,15 @@
# Security notices relating to PHPMailer

Please disclose any vulnerabilities found responsibly - report any security problems found to the maintainers privately.
Please disclose any security issues or vulnerabilities found through [Tidelift's coordinated disclosure system](https://tidelift.com/security) or to the maintainers privately.

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the `$patternselect` parameter to `validateAddress()` is set to `'php'` (the default, defined by `PHPMailer::$validator`), and the global namespace contains a function called `php`, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names. Recorded as [CVE-2021-3603](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3603). Reported by [Vikrant Singh Chauhan](mailto:vi@hackberry.xyz) via [huntr.dev](https://www.huntr.dev/).

PHPMailer versions 6.4.1 and earlier contain a possible remote code execution vulnerability through the `$lang_path` parameter of the `setLanguage()` method. If the `$lang_path` parameter is passed unfiltered from user input, it can be set to [a UNC path](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#unc-paths), and if an attacker is also able to persuade the server to load a file from that UNC path, a script file under their control may be executed. This vulnerability only applies to systems that resolve UNC paths, typically only Microsoft Windows.
PHPMailer 6.5.0 mitigates this by no longer treating translation files as PHP code, but by parsing their text content directly. This approach avoids the possibility of executing unknown code while retaining backward compatibility. This isn't ideal, so the current translation format is deprecated and will be replaced in the next major release. Recorded as [CVE-2021-34551](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34551). Reported by [Jilin Diting Information Technology Co., Ltd](https://listensec.com) via Tidelift.

PHPMailer versions between 6.1.8 and 6.4.0 contain a regression of the earlier CVE-2018-19296 object injection vulnerability as a result of [a fix for Windows UNC paths in 6.1.8](https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9). Recorded as [CVE-2020-36326](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36326). Reported by Fariskhi Vidyan via Tidelift. 6.4.1 fixes this issue, and also enforces stricter checks for URL schemes in local path contexts.

PHPMailer versions 6.1.5 and earlier contain an output escaping bug that occurs in `Content-Type` and `Content-Disposition` when filenames passed into `addAttachment` and other methods that accept attachment names contain double quote characters, in contravention of RFC822 3.4.1. No specific vulnerability has been found relating to this, but it could allow file attachments to bypass attachment filters that are based on matching filename extensions. Recorded as [CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625). Reported by Elar Lang of Clarified Security.

PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing `phar://` paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. Recorded as [CVE-2018-19296](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19296). See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.

Expand Down
2 changes: 1 addition & 1 deletion application/third_party/phpmailer/VERSION
@@ -1 +1 @@
6.0.7
6.5.0
40 changes: 28 additions & 12 deletions application/third_party/phpmailer/composer.json
Expand Up @@ -19,26 +19,34 @@
"name": "Brent R. Matzelle"
}
],
"funding": [
{
"url": "https://github.com/Synchro",
"type": "github"
}
],
"require": {
"php": ">=5.5.0",
"ext-ctype": "*",
"ext-filter": "*"
"ext-filter": "*",
"ext-hash": "*"
},
"require-dev": {
"friendsofphp/php-cs-fixer": "^2.2",
"phpdocumentor/phpdocumentor": "2.*",
"phpunit/phpunit": "^4.8 || ^5.7",
"zendframework/zend-serializer": "2.7.*",
"doctrine/annotations": "1.2.*",
"zendframework/zend-eventmanager": "3.0.*",
"zendframework/zend-i18n": "2.7.3"
"dealerdirect/phpcodesniffer-composer-installer": "^0.7.0",
"doctrine/annotations": "^1.2",
"php-parallel-lint/php-console-highlighter": "^0.5.0",
"php-parallel-lint/php-parallel-lint": "^1.3",
"phpcompatibility/php-compatibility": "^9.3.5",
"roave/security-advisories": "dev-latest",
"squizlabs/php_codesniffer": "^3.6.0",
"yoast/phpunit-polyfills": "^1.0.0"
},
"suggest": {
"psr/log": "For optional PSR-3 debug logging",
"league/oauth2-google": "Needed for Google XOAUTH2 authentication",
"ext-mbstring": "Needed to send email in multibyte encoding charset or decode encoded addresses",
"hayageek/oauth2-yahoo": "Needed for Yahoo XOAUTH2 authentication",
"league/oauth2-google": "Needed for Google XOAUTH2 authentication",
"psr/log": "For optional PSR-3 debug logging",
"stevenmaguire/oauth2-microsoft": "Needed for Microsoft XOAUTH2 authentication",
"ext-mbstring": "Needed to send email in multibyte encoding charset",
"symfony/polyfill-mbstring": "To support UTF-8 if the Mbstring PHP extension is not enabled (^1.2)"
},
"autoload": {
Expand All @@ -51,5 +59,13 @@
"PHPMailer\\Test\\": "test/"
}
},
"license": "LGPL-2.1"
"license": "LGPL-2.1-only",
"scripts": {
"check": "./vendor/bin/phpcs",
"test": "./vendor/bin/phpunit --no-coverage",
"coverage": "./vendor/bin/phpunit",
"lint": [
"@php ./vendor/php-parallel-lint/php-parallel-lint/parallel-lint . -e php,phps --exclude vendor --exclude .git --exclude build"
]
}
}
@@ -1,4 +1,5 @@
<?php

/**
* Arabic PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand All @@ -18,8 +19,7 @@
$PHPMAILER_LANG['invalid_address'] = 'الإرسال غير ممكن لأن عنوان البريد الإلكتروني غير صالح: ';
$PHPMAILER_LANG['mailer_not_supported'] = ' برنامج الإرسال غير مدعوم.';
$PHPMAILER_LANG['provide_address'] = 'يجب توفير عنوان البريد الإلكتروني لمستلم واحد على الأقل.';
$PHPMAILER_LANG['recipients_failed'] = 'خطأ SMTP: الأخطاء التالية ' .
'فشل في الارسال لكل من : ';
$PHPMAILER_LANG['recipients_failed'] = 'خطأ SMTP: الأخطاء التالية فشل في الارسال لكل من : ';
$PHPMAILER_LANG['signing'] = 'خطأ في التوقيع: ';
$PHPMAILER_LANG['smtp_connect_failed'] = 'SMTP Connect() غير ممكن.';
$PHPMAILER_LANG['smtp_error'] = 'خطأ على مستوى الخادم SMTP: ';
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Azerbaijani PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Bosnian PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand All @@ -23,4 +24,4 @@
$PHPMAILER_LANG['smtp_connect_failed'] = 'Spajanje na SMTP server nije uspjelo.';
$PHPMAILER_LANG['smtp_error'] = 'SMTP greška: ';
$PHPMAILER_LANG['variable_set'] = 'Nije moguće postaviti varijablu ili je vratiti nazad: ';
$PHPMAILER_LANG['extension_missing'] = 'Nedostaje ekstenzija: ';
$PHPMAILER_LANG['extension_missing'] = 'Nedostaje ekstenzija: ';
@@ -1,4 +1,5 @@
<?php

/**
* Belarusian PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Bulgarian PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Catalan PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Chinese PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Czech PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand All @@ -15,6 +16,8 @@
$PHPMAILER_LANG['from_failed'] = 'Následující adresa odesílatele je nesprávná: ';
$PHPMAILER_LANG['instantiate'] = 'Nelze vytvořit instanci emailové funkce.';
$PHPMAILER_LANG['invalid_address'] = 'Neplatná adresa: ';
$PHPMAILER_LANG['invalid_hostentry'] = 'Záznam hostitele je nesprávný: ';
$PHPMAILER_LANG['invalid_host'] = 'Hostitel je nesprávný: ';
$PHPMAILER_LANG['mailer_not_supported'] = ' mailer není podporován.';
$PHPMAILER_LANG['provide_address'] = 'Musíte zadat alespoň jednu emailovou adresu příjemce.';
$PHPMAILER_LANG['recipients_failed'] = 'Chyba SMTP: Následující adresy příjemců nejsou správně: ';
Expand Down
33 changes: 18 additions & 15 deletions application/third_party/phpmailer/language/phpmailer.lang-da.php
@@ -1,26 +1,29 @@
<?php

/**
* Danish PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
* @author Mikael Stokkebro <info@stokkebro.dk>
* @author John Sebastian <jms@iwb.dk>
* Rewrite and extension of the work by Mikael Stokkebro <info@stokkebro.dk>
*
*/

$PHPMAILER_LANG['authenticate'] = 'SMTP fejl: Kunne ikke logge på.';
$PHPMAILER_LANG['connect_host'] = 'SMTP fejl: Kunne ikke tilslutte SMTP serveren.';
$PHPMAILER_LANG['data_not_accepted'] = 'SMTP fejl: Data kunne ikke accepteres.';
//$PHPMAILER_LANG['empty_message'] = 'Message body empty';
$PHPMAILER_LANG['authenticate'] = 'SMTP fejl: Login mislykkedes.';
$PHPMAILER_LANG['connect_host'] = 'SMTP fejl: Forbindelse til SMTP serveren kunne ikke oprettes.';
$PHPMAILER_LANG['data_not_accepted'] = 'SMTP fejl: Data blev ikke accepteret.';
$PHPMAILER_LANG['empty_message'] = 'Meddelelsen er uden indhold';
$PHPMAILER_LANG['encoding'] = 'Ukendt encode-format: ';
$PHPMAILER_LANG['execute'] = 'Kunne ikke køre: ';
$PHPMAILER_LANG['file_access'] = 'Ingen adgang til fil: ';
$PHPMAILER_LANG['execute'] = 'Kunne ikke afvikle: ';
$PHPMAILER_LANG['file_access'] = 'Kunne ikke tilgå filen: ';
$PHPMAILER_LANG['file_open'] = 'Fil fejl: Kunne ikke åbne filen: ';
$PHPMAILER_LANG['from_failed'] = 'Følgende afsenderadresse er forkert: ';
$PHPMAILER_LANG['instantiate'] = 'Kunne ikke initialisere email funktionen.';
//$PHPMAILER_LANG['invalid_address'] = 'Invalid address: ';
$PHPMAILER_LANG['instantiate'] = 'Email funktionen kunne ikke initialiseres.';
$PHPMAILER_LANG['invalid_address'] = 'Udgyldig adresse: ';
$PHPMAILER_LANG['mailer_not_supported'] = ' mailer understøttes ikke.';
$PHPMAILER_LANG['provide_address'] = 'Du skal indtaste mindst en modtagers emailadresse.';
$PHPMAILER_LANG['provide_address'] = 'Indtast mindst en modtagers email adresse.';
$PHPMAILER_LANG['recipients_failed'] = 'SMTP fejl: Følgende modtagere er forkerte: ';
//$PHPMAILER_LANG['signing'] = 'Signing Error: ';
//$PHPMAILER_LANG['smtp_connect_failed'] = 'SMTP Connect() failed.';
//$PHPMAILER_LANG['smtp_error'] = 'SMTP server error: ';
//$PHPMAILER_LANG['variable_set'] = 'Cannot set or reset variable: ';
//$PHPMAILER_LANG['extension_missing'] = 'Extension missing: ';
$PHPMAILER_LANG['signing'] = 'Signeringsfejl: ';
$PHPMAILER_LANG['smtp_connect_failed'] = 'SMTP Connect() fejlede.';
$PHPMAILER_LANG['smtp_error'] = 'SMTP server fejl: ';
$PHPMAILER_LANG['variable_set'] = 'Kunne ikke definere eller nulstille variablen: ';
$PHPMAILER_LANG['extension_missing'] = 'Udvidelse mangler: ';
@@ -1,4 +1,5 @@
<?php

/**
* German PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand All @@ -15,6 +16,8 @@
$PHPMAILER_LANG['from_failed'] = 'Die folgende Absenderadresse ist nicht korrekt: ';
$PHPMAILER_LANG['instantiate'] = 'Mail-Funktion konnte nicht initialisiert werden.';
$PHPMAILER_LANG['invalid_address'] = 'Die Adresse ist ungültig: ';
$PHPMAILER_LANG['invalid_hostentry'] = 'Ungültiger Hosteintrag: ';
$PHPMAILER_LANG['invalid_host'] = 'Ungültiger Host: ';
$PHPMAILER_LANG['mailer_not_supported'] = ' mailer wird nicht unterstützt.';
$PHPMAILER_LANG['provide_address'] = 'Bitte geben Sie mindestens eine Empfängeradresse an.';
$PHPMAILER_LANG['recipients_failed'] = 'SMTP-Fehler: Die folgenden Empfänger sind nicht korrekt: ';
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Greek PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Esperanto PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Spanish PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Estonian PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Persian/Farsi PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand All @@ -24,4 +25,4 @@
$PHPMAILER_LANG['smtp_connect_failed'] = 'خطا در اتصال به SMTP.';
$PHPMAILER_LANG['smtp_error'] = 'خطا در SMTP Server: ';
$PHPMAILER_LANG['variable_set'] = 'امکان ارسال یا ارسال مجدد متغیر‌ها وجود ندارد: ';
//$PHPMAILER_LANG['extension_missing'] = 'Extension missing: ';
$PHPMAILER_LANG['extension_missing'] = 'افزونه موجود نیست: ';
@@ -1,4 +1,5 @@
<?php

/**
* Finnish PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Faroese PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* French PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand All @@ -19,6 +20,8 @@
$PHPMAILER_LANG['from_failed'] = 'L\'adresse d\'expéditeur suivante a échoué : ';
$PHPMAILER_LANG['instantiate'] = 'Impossible d\'instancier la fonction mail.';
$PHPMAILER_LANG['invalid_address'] = 'L\'adresse courriel n\'est pas valide : ';
$PHPMAILER_LANG['invalid_hostentry'] = 'L\'entrée hôte n\'est pas valide : ';
$PHPMAILER_LANG['invalid_host'] = 'L\'hôte n\'est pas valide : ';
$PHPMAILER_LANG['mailer_not_supported'] = ' client de messagerie non supporté.';
$PHPMAILER_LANG['provide_address'] = 'Vous devez fournir au moins une adresse de destinataire.';
$PHPMAILER_LANG['recipients_failed'] = 'Erreur SMTP : les destinataires suivants sont en erreur : ';
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Galician PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Hebrew PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,10 +1,11 @@
<?php

/**
* Hindi PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
* @author Yash Karanke <mr.karanke@gmail.com>
*/

$PHPMAILER_LANG['authenticate'] = 'SMTP त्रुटि: प्रामाणिकता की जांच नहीं हो सका। ';
$PHPMAILER_LANG['connect_host'] = 'SMTP त्रुटि: SMTP सर्वर से कनेक्ट नहीं हो सका। ';
$PHPMAILER_LANG['data_not_accepted'] = 'SMTP त्रुटि: डेटा स्वीकार नहीं किया जाता है। ';
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Croatian PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Hungarian PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
28 changes: 16 additions & 12 deletions application/third_party/phpmailer/language/phpmailer.lang-id.php
@@ -1,27 +1,31 @@
<?php

/**
* Indonesian PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
* @author Cecep Prawiro <cecep.prawiro@gmail.com>
* @author @januridp
* @author Ian Mustafa <mail@ianmustafa.com>
*/

$PHPMAILER_LANG['authenticate'] = 'Kesalahan SMTP: Tidak dapat mengotentikasi.';
$PHPMAILER_LANG['connect_host'] = 'Kesalahan SMTP: Tidak dapat terhubung ke host SMTP.';
$PHPMAILER_LANG['data_not_accepted'] = 'Kesalahan SMTP: Data tidak diterima.';
$PHPMAILER_LANG['empty_message'] = 'Isi pesan kosong';
$PHPMAILER_LANG['encoding'] = 'Pengkodean karakter tidak dikenali: ';
$PHPMAILER_LANG['execute'] = 'Tidak dapat menjalankan proses : ';
$PHPMAILER_LANG['file_access'] = 'Tidak dapat mengakses berkas : ';
$PHPMAILER_LANG['file_open'] = 'Kesalahan File: Berkas tidak dapat dibuka : ';
$PHPMAILER_LANG['from_failed'] = 'Alamat pengirim berikut mengakibatkan kesalahan : ';
$PHPMAILER_LANG['instantiate'] = 'Tidak dapat menginisialisasi fungsi surel';
$PHPMAILER_LANG['invalid_address'] = 'Gagal terkirim, alamat surel tidak benar : ';
$PHPMAILER_LANG['provide_address'] = 'Harus disediakan minimal satu alamat tujuan';
$PHPMAILER_LANG['execute'] = 'Tidak dapat menjalankan proses: ';
$PHPMAILER_LANG['file_access'] = 'Tidak dapat mengakses berkas: ';
$PHPMAILER_LANG['file_open'] = 'Kesalahan Berkas: Berkas tidak dapat dibuka: ';
$PHPMAILER_LANG['from_failed'] = 'Alamat pengirim berikut mengakibatkan kesalahan: ';
$PHPMAILER_LANG['instantiate'] = 'Tidak dapat menginisialisasi fungsi surel.';
$PHPMAILER_LANG['invalid_address'] = 'Gagal terkirim, alamat surel tidak sesuai: ';
$PHPMAILER_LANG['invalid_hostentry'] = 'Gagal terkirim, entri host tidak sesuai: ';
$PHPMAILER_LANG['invalid_host'] = 'Gagal terkirim, host tidak sesuai: ';
$PHPMAILER_LANG['provide_address'] = 'Harus tersedia minimal satu alamat tujuan';
$PHPMAILER_LANG['mailer_not_supported'] = ' mailer tidak didukung';
$PHPMAILER_LANG['recipients_failed'] = 'Kesalahan SMTP: Alamat tujuan berikut menghasilkan kesalahan : ';
$PHPMAILER_LANG['signing'] = 'Kesalahan dalam tanda tangan : ';
$PHPMAILER_LANG['recipients_failed'] = 'Kesalahan SMTP: Alamat tujuan berikut menyebabkan kesalahan: ';
$PHPMAILER_LANG['signing'] = 'Kesalahan dalam penandatangan SSL: ';
$PHPMAILER_LANG['smtp_connect_failed'] = 'SMTP Connect() gagal.';
$PHPMAILER_LANG['smtp_error'] = 'Kesalahan pada pelayan SMTP : ';
$PHPMAILER_LANG['variable_set'] = 'Tidak dapat mengatur atau mengatur ulang variable : ';
$PHPMAILER_LANG['extension_missing'] = 'Ekstensi hilang: ';
$PHPMAILER_LANG['smtp_error'] = 'Kesalahan pada pelayan SMTP: ';
$PHPMAILER_LANG['variable_set'] = 'Tidak dapat mengatur atau mengatur ulang variabel: ';
$PHPMAILER_LANG['extension_missing'] = 'Ekstensi PHP tidak tersedia: ';
@@ -1,4 +1,5 @@
<?php

/**
* Italian PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Japanese PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down
@@ -1,4 +1,5 @@
<?php

/**
* Georgian PHPMailer language file: refer to English translation for definitive list
* @package PHPMailer
Expand Down

0 comments on commit c425c55

Please sign in to comment.