Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:97634
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.17.20 as permitted sender)
To: Nikita Popov <nikita.ppv@gmail.com>, Yasuo Ohgaki <yohgaki@ohgaki.net>
References: <CAGa2bXbgPpO4CfHyHrDDhbXsysk7HDsc17nQoGtWNv4zdaq5kA@mail.gmail.com>
 <CAGa2bXZuKmGJu2bnnoqi1DjnyvBL=9VLM=jgffXFfoWf4SJk3Q@mail.gmail.com>
 <CAF+90c9fH4qUc8p4m5+8Q+P+gsKP8sOxGVw2sx5fSVvKHtf4Pg@mail.gmail.com>
 <CAGa2bXbjpEBGj3=U_d2yg6qHhzW-1+zY_2AvBZQJSyep5kMUfw@mail.gmail.com>
 <CAF+90c9PH4ZFsvPNDZxom7WhRA07k4d73f7d+Tjsb1WzBHpb7w@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <438c2044-9c79-3d4c-f708-f7ce54aae905@gmx.de>
Date: Mon, 9 Jan 2017 17:56:49 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.6.0
MIME-Version: 1.0
In-Reply-To: <CAF+90c9PH4ZFsvPNDZxom7WhRA07k4d73f7d+Tjsb1WzBHpb7w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: Improving mail() 5th parameter handling
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 09.01.2017 at 17:23, Nikita Popov wrote:

> On Sun, Jan 8, 2017 at 11:56 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> 
>> Hi Nikita and all,
>>
>> On Mon, Jan 9, 2017 at 7:31 AM, Nikita Popov <nikita.ppv@gmail.com> wrote:
>>
>>> Without this option, how do you specify the envelope sender? That seems
>>> to be the primary use-case.
>>
>>
>> Indeed, it seems it is.
>> It could be set by mail.force_extra_parameters. I agree this isn't a great
>> way to do, but the obstacle may help users to notice risks.
>>
>> Parameters must be validated still, but it will help in most cases and I
>> don't mind writing patch for arrayed 'addtional_parameter'. In this case,
>> I'll just fix this as normal bug fix and post proposed patch before commit.
>> Any comments on this?
> 
> Allowing an array for additional_parameter sounds reasonable. Before
> committing a patch, please lets make sure that people from phpmailer and
> other people familiar with the recent exploits verify it.

See bug #73842.

-- 
Christoph M. Becker