# mail.force_extra_parameters

- Thread: https://externals.io/message/32304
- Original archive: https://news-web.php.net/php.internals/32304
- Started by Stanislav Malyshev on 2007-09-12T22:45:30+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #32304 — Stanislav Malyshev — 2007-09-12T22:45:30+00:00

URL: https://externals.io/message/32304#32304

Would anyone object to disallowing setting mail.force_extra_parameters 
from .htaccess? The problem is that mail.force_extra_parameters can pass 
arbitrary arguments to mail tool, and some mail tools (especially one, 
guess which ;) have a lot of parameters, that allow, in particular, 
reading and writing arbitrary files - which may be a problem with 
safe_mode (yes, I know, but we are still in 5.x) and open_basedir.
I understand that mail.force_extra_parameters was meant for sysadmins 
anyway, so disallowing .htaccess to change it seems ok. Objections?
-- 
Stanislav Malyshev, Zend Software Architect
stas@zend.com   http://www.zend.com/
(408)253-8829   MSN: stas@zend.com

---

## #32305 — David Coallier — 2007-09-12T23:04:53+00:00

URL: https://externals.io/message/32304#32305 · In reply to: #32304

> Would anyone object to disallowing setting mail.force_extra_parameters
> from .htaccess? The problem is that mail.force_extra_parameters can pass
> arbitrary arguments to mail tool, and some mail tools (especially one,
> guess which ;) have a lot of parameters, that allow, in particular,
> reading and writing arbitrary files - which may be a problem with
> safe_mode (yes, I know, but we are still in 5.x) and open_basedir.
> I understand that mail.force_extra_parameters was meant for sysadmins
> anyway, so disallowing .htaccess to change it seems ok. Objections?
> --

You definitely got a +10000 from me for the exact same reasons, it's
for sysadmins and if you have that in your .htaccess I believe this is
a problem.


> Stanislav Malyshev, Zend Software Architect
> stas@zend.com   http://www.zend.com/
> (408)253-8829   MSN: stas@zend.com
>
> --
> 
> 
>
>


-- 
David Coallier,
Founder & Software Architect,
Agora Production (http://agoraproduction.com)
51.42.06.70.18

---

## #32307 — Jacques Marneweck — 2007-09-13T09:58:12+00:00

URL: https://externals.io/message/32304#32307 · In reply to: #32305

> 
> > […]
>
> You definitely got a +10000 from me for the exact same reasons, it's
> for sysadmins and if you have that in your .htaccess I believe this is
> a problem.
>

+1  One less thing for users to change.

Regards
--jm

>
> > […]
>
>
> -- 
> David Coallier,
> Founder & Software Architect,
> Agora Production (http://agoraproduction.com)
> 51.42.06.70.18