Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:97631
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.174 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbjpEBGj3=U_d2yg6qHhzW-1+zY_2AvBZQJSyep5kMUfw@mail.gmail.com>
References: <CAGa2bXbgPpO4CfHyHrDDhbXsysk7HDsc17nQoGtWNv4zdaq5kA@mail.gmail.com>
 <CAGa2bXZuKmGJu2bnnoqi1DjnyvBL=9VLM=jgffXFfoWf4SJk3Q@mail.gmail.com>
 <CAF+90c9fH4qUc8p4m5+8Q+P+gsKP8sOxGVw2sx5fSVvKHtf4Pg@mail.gmail.com> <CAGa2bXbjpEBGj3=U_d2yg6qHhzW-1+zY_2AvBZQJSyep5kMUfw@mail.gmail.com>
Date: Mon, 9 Jan 2017 17:23:21 +0100
Message-ID: <CAF+90c9PH4ZFsvPNDZxom7WhRA07k4d73f7d+Tjsb1WzBHpb7w@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f403045e6a86462cda0545abc981
Subject: Re: [PHP-DEV] Re: Improving mail() 5th parameter handling
From: nikita.ppv@gmail.com (Nikita Popov)

--f403045e6a86462cda0545abc981
Content-Type: text/plain; charset=UTF-8

On Sun, Jan 8, 2017 at 11:56 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi Nikita and all,
>
> On Mon, Jan 9, 2017 at 7:31 AM, Nikita Popov <nikita.ppv@gmail.com> wrote:
>
>> Without this option, how do you specify the envelope sender? That seems
>> to be the primary use-case.
>
>
> Indeed, it seems it is.
> It could be set by mail.force_extra_parameters. I agree this isn't a great
> way to do, but the obstacle may help users to notice risks.
>
> Parameters must be validated still, but it will help in most cases and I
> don't mind writing patch for arrayed 'addtional_parameter'. In this case,
> I'll just fix this as normal bug fix and post proposed patch before commit.
> Any comments on this?
>

Allowing an array for additional_parameter sounds reasonable. Before
committing a patch, please lets make sure that people from phpmailer and
other people familiar with the recent exploits verify it.

Nikita

--f403045e6a86462cda0545abc981--