Passed
Push — development ( 171f18...98bd13 )
by Thomas
02:07
created

htdocs/lib2/mail.class.php (2 issues)

Check for unsafe use of request data

Header Injection Security Critical

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/***************************************************************************
3
 * for license information see doc/license.txt
4
 ***************************************************************************/
5
6
require_once __DIR__ . '/../vendor/autoload.php';
7
8
class mail extends Smarty
9
{
10
    public $name = 'sys_nothing';
11
    public $main_template = 'sys_main';
12
    public $recipient_locale = null;
13
14
    public $from = '';
15
    public $to = '';
16
    public $subject = '';
17
18
    public $replyTo = null;
19
    public $returnPath = null;
20
21
    public $headers = array();
22
23
    /**
24
     * mail constructor.
25
     */
26
    public function __construct()
27
    {
28
        parent::__construct();
29
30
        global $opt;
31
32
        $this->template_dir = __DIR__ . '/../templates2/mail/';
33
        $this->compile_dir = __DIR__ . '/../var/cache2/smarty/compiled/';
34
        $this->plugins_dir = [
35
            'plugins',
36
            __DIR__ . '/../src/Oc/SmartyPlugins'
37
        ];
38
39
        // disable caching ...
40
        $this->caching = false;
41
42
        // register additional functions
43
        $this->load_filter('pre', 't');
44
45
        // cache control
46
        if (($opt['debug'] & DEBUG_TEMPLATES) == DEBUG_TEMPLATES) {
47
            $this->force_compile = true;
48
        }
49
50
        $this->from = $opt['mail']['from'];
51
    }
52
53
    /**
54
     * @return string
55
     */
56
    public function get_compile_id()
57
    {
58
        global $opt;
59
60
        return 'mail|' . $opt['template']['locale'] . '|' . $this->compile_id;
61
    }
62
63
    /**
64
     * @param $name
65
     * @param $rs
66
     */
67 View Code Duplication
    public function assign_rs($name, $rs)
68
    {
69
        $items = array();
70
        while ($r = sql_fetch_assoc($rs)) {
71
            $items[] = $r;
72
        }
73
        $this->assign($name, $items);
74
    }
75
76
    /**
77
     * @param bool $page_url
78
     *
79
     * @return bool
80
     */
81
    public function send($page_url = false)
82
    {
83
        global $tpl, $opt;
84
85
        if (!$this->template_exists($this->name . '.tpl')) {
86
            $tpl->error(ERROR_MAIL_TEMPLATE_NOT_FOUND);
87
        }
88
        $this->assign('template', $this->name);
89
        if (!$this->recipient_locale) {
90
            $this->recipient_locale = $opt['template']['locale'];
91
        }
92
93
        $optn['mail']['contact'] = $opt['mail']['contact'];
94
        $optn['page']['absolute_url'] = ($page_url ? $page_url : $opt['page']['absolute_url']);
95
        $optn['page']['sitename'] = $opt['page']['sitename'];
96
        $optn['format'] = $opt['locale'][$this->recipient_locale]['format'];
97
        $this->assign('opt', $optn);
98
99
        $this->assign('to', $this->to);
100
        $this->assign('from', $this->from);
101
        $this->assign('subject', $this->subject);
102
103
        // This is nasty, but as there is only a global translation system
104
        // (based on gettext) and there are no precompiled, language-dependend email
105
        // templates available, we must temporarily change the locale according to
106
        // the recipient's locale. If some error occurs while running fetch(),
107
        // the error message may be displayed in the recipient's language.
108
109
        $sender_locale = $opt['template']['locale'];
110
        if ($this->recipient_locale != $sender_locale) {
111
            $opt['template']['locale'] = $this->recipient_locale;
112
            set_php_locale();
113
        }
114
115
        $body = $this->fetch($this->main_template . '.tpl', '', $this->get_compile_id());
116
117
        if ($this->recipient_locale != $sender_locale) {
118
            $opt['template']['locale'] = $sender_locale;
119
            set_php_locale();
120
        }
121
122
        // check if the target domain exists if the domain does not
123
        // exist, the mail is sent to the own domain (?!)
124
        $domain = mail::getToMailDomain($this->to);
125
        if (mail::is_existent_maildomain($domain) == false) {
126
            return false;
127
        }
128
129
        $aAddHeaders = array();
130
        $aAddHeaders[] = 'From: "' . $this->from . '" <' . $this->from . '>';
131
132
        if ($this->replyTo !== null) {
133
            $aAddHeaders[] = 'Reply-To: ' . $this->replyTo;
134
        }
135
136
        if ($this->returnPath !== null) {
137
            $aAddHeaders[] = 'Return-Path: ' . $this->returnPath;
138
        }
139
140
        $mailHeaders = implode("\n", array_merge($aAddHeaders, $this->headers));
141
142
        return mb_send_mail($this->to, $opt['mail']['subject'] . $this->subject, $body, $mailHeaders);
0 ignored issues
show
Security Header Injection introduced by
$this->to can contain request data and is used in request header context(s) leading to a potential security vulnerability.

18 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned in htdocs/addtolist.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned
    in htdocs/addtolist.php on line 26
  2. $newListName is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 38
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  9. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  10. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  11. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 33
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 33
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  8. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  9. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 26
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  8. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  9. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  4. Path: Read from $_POST, and $logText is assigned in htdocs/log.php on line 111
  1. Read from $_POST, and $logText is assigned
    in htdocs/log.php on line 111
  2. Data is escaped by htmlspecialchars() for html (no single-quotes) context(s), and Data is passed through nl2br()
    in vendor/htdocs/lib2/edithelper.inc.php on line 50
  3. $logText is assigned
    in htdocs/log.php on line 206
  4. $logText is passed to cachelog::setText()
    in htdocs/log.php on line 301
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelog.class.php on line 211
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  10. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  11. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  12. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  5. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 20
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 20
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 58
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  9. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  10. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  9. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  10. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  7. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  9. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  10. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  8. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 60
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 60
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  8. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  9. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  9. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 17
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 40
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  9. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  10. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  10. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 68
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 68
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  8. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  9. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  11. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 16
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 44
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  9. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  10. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  12. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 20
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 20
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 30
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  9. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  10. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  13. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 52
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 52
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  8. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  9. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  14. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 15
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 15
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 35
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  9. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  10. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  9. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  10. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  11. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  16. Path: Read from $_FILES, and $_FILES['file']['name'] is escaped by pathinfo() for file context(s), and $fname is assigned in htdocs/picture.php on line 117
  1. Read from $_FILES, and $_FILES['file']['name'] is escaped by pathinfo() for file context(s), and $fname is assigned
    in htdocs/picture.php on line 117
  2. $fname is passed through mb_strtolower(), and mb_strtolower($fname) . '.jpg' is passed to picture::setFilenames()
    in htdocs/picture.php on line 130
  3. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  4. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  10. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  11. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  12. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  17. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 18
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 18
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 53
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  9. user::getEMail() returns tainted data, and $email is assigned
    in htdocs/lib2/logic/user.class.php on line 781
  10. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 793
  11. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142
  18. Path: Read from $_REQUEST, and $email is assigned in htdocs/newemail.php on line 22
  1. Read from $_REQUEST, and $email is assigned
    in htdocs/newemail.php on line 22
  2. $email is passed to user::requestNewEMail()
    in htdocs/newemail.php on line 41
  3. mail::$to is assigned
    in htdocs/lib2/logic/user.class.php on line 745
  4. Tainted property mail::$to is read
    in htdocs/lib2/mail.class.php on line 142

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
Security Header Injection introduced by
$mailHeaders can contain request data and is used in request header context(s) leading to a potential security vulnerability.

17 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned in htdocs/addtolist.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned
    in htdocs/addtolist.php on line 26
  2. $newListName is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 38
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  9. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  10. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  11. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 33
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 33
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  8. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  9. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 26
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  8. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  9. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  4. Path: Read from $_POST, and $logText is assigned in htdocs/log.php on line 111
  1. Read from $_POST, and $logText is assigned
    in htdocs/log.php on line 111
  2. Data is escaped by htmlspecialchars() for html (no single-quotes) context(s), and Data is passed through nl2br()
    in vendor/htdocs/lib2/edithelper.inc.php on line 50
  3. $logText is assigned
    in htdocs/log.php on line 206
  4. $logText is passed to cachelog::setText()
    in htdocs/log.php on line 301
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelog.class.php on line 211
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  10. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  11. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  12. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  5. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 20
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 20
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 58
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  9. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  10. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  9. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  10. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  7. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  9. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  10. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  8. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 60
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 60
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  8. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  9. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  9. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 17
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 40
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  9. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  10. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  10. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 68
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 68
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  8. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  9. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  11. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 16
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 44
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  9. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  10. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  12. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 20
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 20
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 30
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  9. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  10. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  13. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 52
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 52
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  7. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  8. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  9. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  14. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 15
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 15
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 35
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  8. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  9. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  10. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  9. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  10. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  11. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  16. Path: Read from $_FILES, and $_FILES['file']['name'] is escaped by pathinfo() for file context(s), and $fname is assigned in htdocs/picture.php on line 117
  1. Read from $_FILES, and $_FILES['file']['name'] is escaped by pathinfo() for file context(s), and $fname is assigned
    in htdocs/picture.php on line 117
  2. $fname is passed through mb_strtolower(), and mb_strtolower($fname) . '.jpg' is passed to picture::setFilenames()
    in htdocs/picture.php on line 130
  3. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  4. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  10. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  11. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  12. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140
  17. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 18
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 18
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 53
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/user.class.php on line 171
  9. user::getEMail() returns tainted data, and mail::$returnPath is assigned
    in htdocs/lib2/logic/user.class.php on line 884
  10. Tainted property mail::$returnPath is read, and $aAddHeaders is assigned
    in htdocs/lib2/mail.class.php on line 137
  11. $aAddHeaders is passed through array_merge(), and array_merge($aAddHeaders, $this->headers) is passed through implode(), and $mailHeaders is assigned
    in htdocs/lib2/mail.class.php on line 140

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
143
    }
144
145
    /**
146
     * @param string $domain
147
     *
148
     * @return bool
149
     */
150
    public static function is_existent_maildomain($domain)
151
    {
152
        if ($domain === 'localhost') {
153
            return true;
154
        }  // allow maintenance mails e.g. to root
155
156
        $smtpServerList = [];
157
        $smtpServerWeight = [];
158
159
        if (getmxrr($domain, $smtpServerList, $smtpServerWeight) !== false && count($smtpServerList) > 0) {
160
            return true;
161
        }
162
163
        // check if A exists
164
        $a = dns_get_record($domain, DNS_A);
165
166
        return count($a) > 0;
167
    }
168
169
    /**
170
     * @param string $mail
171
     *
172
     * @return string
173
     */
174
    public static function getToMailDomain($mail)
175
    {
176
        if ($mail === '') {
177
            return '';
178
        }
179
180
        if (strrpos($mail, '@') === false) {
181
            $domain = 'localhost';
182
        } else {
183
            $domain = substr($mail, strrpos($mail, '@') + 1);
184
        }
185
186
        return $domain;
187
    }
188
}
189