Issues (1752)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/mailsender.php (6 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * @package		fwolflib
4
 * @subpackage	class
5
 * @copyright	Copyright 2007-2008, Fwolf
6
 * @author		Fwolf <[email protected]>
7
 */
8
9
10
require_once(dirname(__FILE__) . '/fwolflib.php');
11
require_once("phpmailer/class.phpmailer.php");
12
13
14
/**
15
 * Mail Sender
16
 *
17
 * Subclass of PHPMailer, make it easier to use.
18
 *
19
 * Usage:
20
 * <code>
21
 * $m = new MailSender();
22
 * $m->SetHost('ssl://smtp.gmail.com', 465, true);
23
 * $m->SetTo($mail_to);
24
 * $m->SetFrom('Who send it ?');
25
 * $m->SetAuth($mail_user, $mail_pass);
26
 * $m->SetSubject($mail_subject);
27
 * $m->SetBody($mail_body);
28
 * $m->SetAttach($mail_attach);
29
 * $m->Send();
30
 * </code>
31
 *
32
 * @deprecated  Use Fwlib\Bridge\PHPMailer
33
 * @package		fwolflib
34
 * @subpackage	class
35
 * @copyright	Copyright 2007-2008, Fwolf
36
 * @author		Fwolf <[email protected]>
37
 * @since		2007-03-29
38
 * @version		$Id$
39
 */
40
class Mailsender extends PHPMailer
41
{
42
	/**
43
	 * Mail attachment
44
	 * Array of string
45
	 * @var	array
46
	 */
47
	public $mAttach = array();
48
49
	/**
50
	 * Mail body
51
	 * @var	string
52
	 */
53
	public $mBody = '';
54
55
	/**
56
	 * Charset of mail
57
	 * @var	string
58
	 */
59
	public $mCharset = 'utf-8';
60
61
	/**
62
	 * Encoding method of mail body
63
	 * @var	string
64
	 */
65
	public $mEncoding = 'base64';
66
67
	/**
68
	 * Error count
69
	 * Reset when mail send success
70
	 * @var	int
71
	 */
72
	public $mErrorCount = 0;
73
74
	/**
75
	 * Error message
76
	 * Reset when mail send success
77
	 * @var string
78
	 */
79
	public $mErrorMsg = '';
80
81
	/**
82
	 * Mail from address
83
	 * @var	string
84
	 */
85
	public $mFrom = '';
86
87
	/**
88
	 * Mail from name
89
	 * @var	string
90
	 */
91
	public $mFromName = 'Aliens';
92
93
	/**
94
	 * Mail host
95
	 * Don't include port number
96
	 * @see	$mPort
97
	 * @var	string
98
	 */
99
	public $mHost = '';
100
101
	/**
102
	 * Html format mail ?
103
	 * @var	boolean
104
	 */
105
	public $mIsHtml = false;
106
107
	/**
108
	 * Auth type
109
	 * Smtp default.
110
	 * @var	string
111
	 */
112
	public $mIsSmtp = true;
113
114
	/**
115
	 * Pass to login mail host
116
	 * @var	string
117
	 */
118
	public $mPass = '';
119
120
	/**
121
	 * Mail host port number
122
	 * @var	int
123
	 */
124
	public $mPort = 25;
125
126
	/**
127
	 * Keep smtp connection to furture useage ?
128
	 * Var in phpmailer is $SMTPKeepAlive default false
129
	 * @var	boolean
130
	 */
131
	public $mSmtpKeepAlive = false;
132
133
	/**
134
	 * Subject of mail
135
	 * @var	string
136
	 */
137
	public $mSubject = '';
138
139
	/**
140
	 * Address to be mailed to
141
	 * Parsed data, always is an array
142
	 * @var	array
143
	 */
144
	public $mTo = array();
145
146
	/**
147
	 * Username on mail host
148
	 * Some host is xxx, while some is [email protected]
149
	 * @var	string
150
	 */
151
	public $mUser = '';
152
153
154
	/**
155
	 * Construct
156
	 */
157
	public function __construct()
158
	{
159
		//parent::PHPMailer();
160
	} // end of func construct
161
162
163
	/**
164
	 * Parse mail to address
165
	 * Input any type address, output standard array of address
166
	 * Parse string including email name and address to address=>name array.
167
	 *
168
	 * @var	mixed	$to
169
	 * @return	array
170
	 */
171
	public function ParseTo($to)
172
	{
173
		if (is_array($to))
174
			return $to;
175
		else
176
		{
177
			//$addresses = ',,,;;; "@1>"1<1 ,\';" <[email protected]> , [email protected], f <[email protected]> ,,[email protected],;;; ';
178
			//$addresses = ', [email protected]';
179
180
			//First, find all mail address out
181
			$j = preg_match_all('/[\s<]?([\w\d\-_\.\+]+@([\w\d\-_]+\.){1,4}\w+)[\s>]?/', $to, $addr_addr);
182
183
			//if got addresses, find names according there position in string
184
			$addr = array();
185
			if (0 < $j)
186
			{
187
				$addr_addr = $addr_addr[1];
188 View Code Duplication
				for ($i=0; $i<$j; $i++)
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
189
				{
190
					//this can always find
191
					$k = strpos($to, $addr_addr[$i]);
192
					$name = substr($to, 0, $k);
193
					//prepare for next loop
194
					$to= substr($to, $k + strlen($addr_addr[$i]));
195
					//trim string we parsed out
196
					$name = trim($name, ' \t<>;,"');
197
					//gerenate addr array like address=>name style
198
					$addr[$addr_addr[$i]] = $name;
199
				}
200
				//foreach ($addr as $key=>$val)
201
				//	echo $key . '=>' . $val . "\n";
202
			}
203
			return($addr);
204
		}
205
	} // end of func ParseTo
206
207
208
	/**
209
	 * Prepare - Common setup
210
	 */
211
	public function Prepare()
212
	{
213
		// NOTICE --> Char'S'et
214
		$this->CharSet = $this->mCharset;
215
		$this->Encoding = $this->mEncoding;
216
		if (true == $this->mIsSmtp)
0 ignored issues
show
Bug Best Practice introduced by
It seems like you are loosely comparing $this->mIsSmtp of type string to the boolean true. If you are specifically checking for a non-empty string, consider using the more explicit !== '' instead.
Loading history...
217
			$this->IsSMTP();
218
		if (true == $this->mIsHtml)
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
219
			$this->IsHTML(true);
220
		else
221
			$this->IsHTML(false);
222
	} // end of func Prepare
223
224
225
	/**
226
	 * Send mail
227
	 * @param	string	$from	Only [email protected] format, no fromname
228
	 * @param	mixed	$to
229
	 * @param	string	$subject
230
	 * @param	string	$body
231
	 * @param	mixed	$attach
232
	 * @return	boolean
233
	 */
234
	public function Send($from = '', $to = '', $subject = '', $body = '', $attach = '')
235
	{
236
		$this->Prepare();
237
		if (!empty($from))
238
			$this->SetFrom($from);
239
		if (!empty($to))
240
			$this->SetTo($to);
241
		if (!empty($subject))
242
			$this->SetSubject($subject);
243
		if (!empty($body))
244
			$this->SetBody($body);
245
		if (!empty($attach))
246
			$this->SetAttach($attach);
247
248
		$sok = parent::Send();
249
		if (false == $sok)
250
		{
251
			$this->mErrorCount ++;
252
			$this->mErrorMsg = $this->ErrorInfo;
253
		}
254
		else
255
		{
256
			$this->mErrorCount = 0;
257
			$this->mErrorMsg = '';
258
		}
259
260
		if (false == $this->mSmtpKeepAlive)
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
261
			$this->SmtpClose();
262
		return $sok;
263
	} // end of function Send
264
265
266
	/**
267
	 * Set mail attachment
268
	 * @param	mixed	$attach
269
	 */
270
	public function SetAttach($attach)
271
	{
272
		if (is_array($attach))
273
		{
274
			$this->mAttach = &$attach;
275
			$this->ClearAttachments();
276
			foreach ($attach as $att)
277
				$this->AddAttachment($att);
278
		}
279
		elseif (!empty($attach))
280
		{
281
			$this->mAttach = array($attach);
282
			$this->AddAttachment($attach);
283
		}
284
	} // end of func SetAttach
285
286
287
	/**
288
	 * Set host auth information
289
	 * @param	string	$userid
290
	 * @param	string	$passwd
291
	 */
292
	public function SetAuth($userid, $passwd)
293
	{
294
		$this->mUser = $userid;
295
		$this->mPass = $passwd;
296
		$this->Username = $this->mUser;
297
		$this->Password = $this->mPass;
298
	} // end of func SetAuth
299
300
301
	/**
302
	 * Set mail body content
303
	 * @param	string	$body
304
	 */
305
	public function SetBody($body)
306
	{
307
		$this->mBody = $body;
308
		$this->Body = $this->mBody;
309
	} // end of func SetBody
310
311
312
	/**
313
	 * Set from & from name
314
	 * @param	string	$from
315
	 * @param	string	$fromname
316
	 */
317
	public function SetFrom($from, $fromname = 'Aliens')
318
	{
319
		$this->mFrom = $from;
320
		$this->mFromName = $fromname;
321
		$this->From = $this->mFrom;
322
		$this->FromName = $this->mFromName;
323
	} // end of func SetFrom
324
325
326
	/**
327
	 * Set host information
328
	 * @param	string	$addr
329
	 * @param	int		$port
330
	 * @param	boolean	$issmtp
331
	 */
332
	public function SetHost($addr, $port = 25, $issmtp = true)
333
	{
334
		$this->mHost = $addr;
335
		$this->mPort = $port;
336
		$this->mIsSmtp = $issmtp;
0 ignored issues
show
Documentation Bug introduced by
The property $mIsSmtp was declared of type string, but $issmtp is of type boolean. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
337
		$this->Host = $this->mHost;
338
		$this->Port = $this->mPort;
339
		$this->SMTPAuth = $this->mIsSmtp;
340
	} // end of func SetHost
341
342
343
	/**
344
	 * Set mail subject
345
	 * @param	string	$sub
346
	 */
347
	public function SetSubject($sub)
348
	{
349
		$this->mSubject = $sub;
350
		$this->Subject = $this->mSubject;
351
	} // end of func SetSubject
352
353
354
	/**
355
	 * Set address to mail to
356
	 * @param	mixed	$to
357
	 */
358
	public function SetTo($to)
359
	{
360
		$to_ar = $this->ParseTo($to);
361
		$this->mTo = &$to_ar;
362
		$this->ClearAddresses();
363
		foreach ($to_ar as $key => $val)
364
			$this->AddAddress($key, $val);
365
	} // end of func SetTo
366
367
}
368
?>
0 ignored issues
show
It is not recommended to use PHP's closing tag ?> in files other than templates.

Using a closing tag in PHP files that only contain PHP code is not recommended as you might accidentally add whitespace after the closing tag which would then be output by PHP. This can cause severe problems, for example headers cannot be sent anymore.

A simple precaution is to leave off the closing tag as it is not required, and it also has no negative effects whatsoever.

Loading history...
369