Commit 9e4f6c4c authored by Zot's avatar Zot

FOAD

parent 98ba44eb
docs/phpdoc/
test/message.txt
test/testbootstrap.php
test/*.pem
build/
vendor/
build:
environment:
php: '5.6.0'
before_commands:
- "composer install --prefer-source"
tools:
external_code_coverage:
enabled: true
timeout: 300
filter:
excluded_paths:
- 'docs/*'
- 'examples/*'
- 'extras/*'
- 'test/*'
- 'vendor/*'
php_code_coverage:
enabled: false
filter:
excluded_paths:
- 'docs/*'
- 'examples/*'
- 'extras/*'
- 'test/*'
- 'vendor/*'
php_code_sniffer:
enabled: true
config:
standard: PSR2
sniffs:
generic:
files:
one_class_per_file_sniff: false
filter:
excluded_paths:
- 'docs/*'
- 'examples/*'
- 'extras/*'
- 'test/*'
- 'vendor/*'
# Copy/Paste Detector
php_cpd:
enabled: true
excluded_dirs:
- docs
- examples
- extras
- test
- vendor
# PHP CS Fixer (http://http://cs.sensiolabs.org/).
php_cs_fixer:
enabled: true
config:
level: psr2
filter:
excluded_paths:
- 'docs/*'
- 'examples/*'
- 'extras/*'
- 'test/*'
- 'vendor/*'
# Analyzes the size and structure of a PHP project.
php_loc:
enabled: true
excluded_dirs:
- docs
- examples
- extras
- test
- vendor
# PHP Mess Detector (http://phpmd.org).
php_mess_detector:
enabled: true
config:
rulesets:
- codesize
- unusedcode
- naming
- design
naming_rules:
short_variable: { minimum: 2 }
filter:
excluded_paths:
- 'docs/*'
- 'examples/*'
- 'extras/*'
- 'test/*'
- 'vendor/*'
# Analyzes the size and structure of a PHP project.
php_pdepend:
enabled: true
excluded_dirs:
- docs
- examples
- extras
- test
- vendor
# Runs Scrutinizer's PHP Analyzer Tool
# https://scrutinizer-ci.com/docs/tools/php/php-analyzer/config_reference
php_analyzer:
enabled: true
config:
checkstyle:
enabled: true
naming:
enabled: true
property_name: ^[_a-zA-Z][a-zA-Z0-9_]*$ #Allow underscores & caps
method_name: ^(?:[_a-zA-Z]|__)[a-zA-Z0-9_]*$ #Allow underscores & caps
parameter_name: ^[a-z][a-zA-Z0-9_]*$ # Allow underscores
local_variable: ^[a-zA-Z][a-zA-Z0-9_]*$ #Allow underscores & caps
exception_name: ^[a-zA-Z][a-zA-Z0-9]*Exception$
isser_method_name: ^(?:[_a-zA-Z]|__)[a-zA-Z0-9]*$ #Allow underscores & caps
filter:
excluded_paths:
- 'docs/*'
- 'examples/*'
- 'extras/*'
- 'test/*'
- 'vendor/*'
# Security Advisory Checker
sensiolabs_security_checker: true
language: php
php:
- 7.0
- 5.6
- 5.5
- 5.4
- 5.3
- hhvm
matrix:
allow_failures:
- php: hhvm
before_install:
- sudo apt-get update -qq
- sudo apt-get install -y -qq postfix
before_script:
- sudo service postfix stop
- smtp-sink -d "%d.%H.%M.%S" localhost:2500 1000 &
- mkdir -p build/logs
- cd test
- cp testbootstrap-dist.php testbootstrap.php
- chmod +x fakesendmail.sh
- sudo mkdir -p /var/qmail/bin
- sudo cp fakesendmail.sh /var/qmail/bin/sendmail
- sudo cp fakesendmail.sh /usr/sbin/sendmail
- echo 'sendmail_path = "/usr/sbin/sendmail -t -i "' > $(php --ini|grep -m 1 "ini files in:"|cut -d ":" -f 2)/sendmail.ini
script:
- phpunit --configuration ../travis.phpunit.xml.dist
after_script:
- wget https://scrutinizer-ci.com/ocular.phar
- php ocular.phar code-coverage:upload --format=php-clover ../build/logs/clover.xml
This diff is collapsed.
<?php
/**
* PHPMailer SPL autoloader.
* PHP Version 5
* @package PHPMailer
* @link https://github.com/PHPMailer/PHPMailer/ The PHPMailer GitHub project
* @author Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
* @author Jim Jagielski (jimjag) <jimjag@gmail.com>
* @author Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
* @author Brent R. Matzelle (original founder)
* @copyright 2012 - 2014 Marcus Bointon
* @copyright 2010 - 2012 Jim Jagielski
* @copyright 2004 - 2009 Andy Prevost
* @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
* @note This program is distributed in the hope that it will be useful - WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE.
*/
/**
* PHPMailer SPL autoloader.
* @param string $classname The name of the class to load
*/
function PHPMailerAutoload($classname)
{
//Can't use __DIR__ as it's only in PHP 5.3+
$filename = dirname(__FILE__).DIRECTORY_SEPARATOR.'class.'.strtolower($classname).'.php';
if (is_readable($filename)) {
require $filename;
}
}
if (version_compare(PHP_VERSION, '5.1.2', '>=')) {
//SPL autoloading was introduced in PHP 5.1.2
if (version_compare(PHP_VERSION, '5.3.0', '>=')) {
spl_autoload_register('PHPMailerAutoload', true, true);
} else {
spl_autoload_register('PHPMailerAutoload');
}
} else {
/**
* Fall back to traditional autoload for old PHP versions
* @param string $classname The name of the class to load
*/
function __autoload($classname)
{
PHPMailerAutoload($classname);
}
}
This diff is collapsed.
# Security notices relating to PHPMailer
Please disclose any vulnerabilities found responsibly - report any security problems found to the maintainers privately.
PHPMailer versions prior to 5.2.14 (released November 2015) are vulnerable to [CVE-2015-8476](https://web.nvd.nist.gov/view/vuln/detail?vulnId=) an SMTP CRLF injection bug permitting arbitrary message sending.
PHPMailer versions prior to 5.2.10 (released May 2015) are vulnerable to [CVE-2008-5619](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5619), a remote code execution vulnerability in the bundled html2text library. This file was removed in 5.2.10, so if you are using a version prior to that and make use of the html2text function, it's vitally important that you upgrade and remove this file.
PHPMailer versions prior to 2.0.7 and 2.2.1 are vulnerable to [CVE-2012-0796](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0796), an email header injection attack.
Joomla 1.6.0 uses PHPMailer in an unsafe way, allowing it to reveal local file paths, reported in [CVE-2011-3747](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3747).
PHPMailer didn't sanitise the `$lang_path` parameter in `SetLanguage`. This wasn't a problem in itself, but some apps (PHPClassifieds, ATutor) also failed to sanitise user-provided parameters passed to it, permitting semi-arbitrary local file inclusion, reported in [CVE-2010-4914](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4914), [CVE-2007-2021](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-2021) and [CVE-2006-5734](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5734).
PHPMailer 1.7.2 and earlier contained a possible DDoS vulnerability reported in [CVE-2005-1807](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1807).
PHPMailer 1.7 and earlier (June 2003) have a possible vulnerability in the `SendmailSend` method where shell commands may not be sanitised. Reported in [CVE-2007-3215](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3215).
5.2.16
\ No newline at end of file
This diff is collapsed.
This diff is collapsed.
<?php
/**
* PHPMailer - PHP email creation and transport class.
* PHP Version 5.4
* @package PHPMailer
* @link https://github.com/PHPMailer/PHPMailer/ The PHPMailer GitHub project
* @author Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
* @author Jim Jagielski (jimjag) <jimjag@gmail.com>
* @author Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
* @author Brent R. Matzelle (original founder)
* @copyright 2012 - 2014 Marcus Bointon
* @copyright 2010 - 2012 Jim Jagielski
* @copyright 2004 - 2009 Andy Prevost
* @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
* @note This program is distributed in the hope that it will be useful - WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE.
*/
/**
* PHPMailerOAuth - PHPMailer subclass adding OAuth support.
* @package PHPMailer
* @author @sherryl4george
* @author Marcus Bointon (@Synchro) <phpmailer@synchromedia.co.uk>
*/
class PHPMailerOAuth extends PHPMailer
{
/**
* The OAuth user's email address
* @var string
*/
public $oauthUserEmail = '';
/**
* The OAuth refresh token
* @var string
*/
public $oauthRefreshToken = '';
/**
* The OAuth client ID
* @var string
*/
public $oauthClientId = '';
/**
* The OAuth client secret
* @var string
*/
public $oauthClientSecret = '';
/**
* An instance of the PHPMailerOAuthGoogle class.
* @var PHPMailerOAuthGoogle
* @access protected
*/
protected $oauth = null;
/**
* Get a PHPMailerOAuthGoogle instance to use.
* @return PHPMailerOAuthGoogle
*/
public function getOAUTHInstance()
{
if (!is_object($this->oauth)) {
$this->oauth = new PHPMailerOAuthGoogle(
$this->oauthUserEmail,
$this->oauthClientSecret,
$this->oauthClientId,
$this->oauthRefreshToken
);
}
return $this->oauth;
}
/**
* Initiate a connection to an SMTP server.
* Overrides the original smtpConnect method to add support for OAuth.
* @param array $options An array of options compatible with stream_context_create()
* @uses SMTP
* @access public
* @return bool
*/
public function smtpConnect($options = array())
{
if (is_null($this->smtp)) {
$this->smtp = $this->getSMTPInstance();
}
if (is_null($this->oauth)) {
$this->oauth = $this->getOAUTHInstance();
}
// Already connected?
if ($this->smtp->connected()) {
return true;
}
$this->smtp->setTimeout($this->Timeout);
$this->smtp->setDebugLevel($this->SMTPDebug);
$this->smtp->setDebugOutput($this->Debugoutput);
$this->smtp->setVerp($this->do_verp);
$hosts = explode(';', $this->Host);
$lastexception = null;
foreach ($hosts as $hostentry) {
$hostinfo = array();
if (!preg_match('/^((ssl|tls):\/\/)*([a-zA-Z0-9\.-]*):?([0-9]*)$/', trim($hostentry), $hostinfo)) {
// Not a valid host entry
continue;
}
// $hostinfo[2]: optional ssl or tls prefix
// $hostinfo[3]: the hostname
// $hostinfo[4]: optional port number
// The host string prefix can temporarily override the current setting for SMTPSecure
// If it's not specified, the default value is used
$prefix = '';
$secure = $this->SMTPSecure;
$tls = ($this->SMTPSecure == 'tls');
if ('ssl' == $hostinfo[2] or ('' == $hostinfo[2] and 'ssl' == $this->SMTPSecure)) {
$prefix = 'ssl://';
$tls = false; // Can't have SSL and TLS at the same time
$secure = 'ssl';
} elseif ($hostinfo[2] == 'tls') {
$tls = true;
// tls doesn't use a prefix
$secure = 'tls';
}
//Do we need the OpenSSL extension?
$sslext = defined('OPENSSL_ALGO_SHA1');
if ('tls' === $secure or 'ssl' === $secure) {
//Check for an OpenSSL constant rather than using extension_loaded, which is sometimes disabled
if (!$sslext) {
throw new phpmailerException($this->lang('extension_missing').'openssl', self::STOP_CRITICAL);
}
}
$host = $hostinfo[3];
$port = $this->Port;
$tport = (integer)$hostinfo[4];
if ($tport > 0 and $tport < 65536) {
$port = $tport;
}
if ($this->smtp->connect($prefix . $host, $port, $this->Timeout, $options)) {
try {
if ($this->Helo) {
$hello = $this->Helo;
} else {
$hello = $this->serverHostname();
}
$this->smtp->hello($hello);
//Automatically enable TLS encryption if:
// * it's not disabled
// * we have openssl extension
// * we are not already using SSL
// * the server offers STARTTLS
if ($this->SMTPAutoTLS and $sslext and $secure != 'ssl' and $this->smtp->getServerExt('STARTTLS')) {
$tls = true;
}
if ($tls) {
if (!$this->smtp->startTLS()) {
throw new phpmailerException($this->lang('connect_host'));
}
// We must resend HELO after tls negotiation
$this->smtp->hello($hello);
}
if ($this->SMTPAuth) {
if (!$this->smtp->authenticate(
$this->Username,
$this->Password,
$this->AuthType,
$this->Realm,
$this->Workstation,
$this->oauth
)
) {
throw new phpmailerException($this->lang('authenticate'));
}
}
return true;
} catch (phpmailerException $exc) {
$lastexception = $exc;
$this->edebug($exc->getMessage());
// We must have connected, but then failed TLS or Auth, so close connection nicely
$this->smtp->quit();
}
}
}
// If we get here, all connection attempts have failed, so close connection hard
$this->smtp->close();
// As we've caught all exceptions, just report whatever the last one was
if ($this->exceptions and !is_null($lastexception)) {
throw $lastexception;
}
return false;
}
}
<?php
/**
* PHPMailer - PHP email creation and transport class.
* PHP Version 5.4
* @package PHPMailer
* @link https://github.com/PHPMailer/PHPMailer/ The PHPMailer GitHub project
* @author Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
* @author Jim Jagielski (jimjag) <jimjag@gmail.com>
* @author Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
* @author Brent R. Matzelle (original founder)
* @copyright 2012 - 2014 Marcus Bointon
* @copyright 2010 - 2012 Jim Jagielski
* @copyright 2004 - 2009 Andy Prevost
* @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
* @note This program is distributed in the hope that it will be useful - WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE.
*/
/**
* PHPMailerOAuthGoogle - Wrapper for League OAuth2 Google provider.
* @package PHPMailer
* @author @sherryl4george
* @author Marcus Bointon (@Synchro) <phpmailer@synchromedia.co.uk>
* @link https://github.com/thephpleague/oauth2-client
*/
class PHPMailerOAuthGoogle
{
private $oauthUserEmail = '';
private $oauthRefreshToken = '';
private $oauthClientId = '';
private $oauthClientSecret = '';
/**
* @param string $UserEmail
* @param string $ClientSecret
* @param string $ClientId
* @param string $RefreshToken
*/
public function __construct(
$UserEmail,
$ClientSecret,
$ClientId,
$RefreshToken
) {
$this->oauthClientId = $ClientId;
$this->oauthClientSecret = $ClientSecret;
$this->oauthRefreshToken = $RefreshToken;
$this->oauthUserEmail = $UserEmail;
}
private function getProvider()
{
return new League\OAuth2\Client\Provider\Google([
'clientId' => $this->oauthClientId,
'clientSecret' => $this->oauthClientSecret
]);
}
private function getGrant()
{
return new \League\OAuth2\Client\Grant\RefreshToken();
}
private function getToken()
{
$provider = $this->getProvider();
$grant = $this->getGrant();
return $provider->getAccessToken($grant, ['refresh_token' => $this->oauthRefreshToken]);
}
public function getOauth64()
{
$token = $this->getToken();
return base64_encode("user=" . $this->oauthUserEmail . "\001auth=Bearer " . $token . "\001\001");
}
}
This diff is collapsed.
This diff is collapsed.
{
"name": "phpmailer/phpmailer",
"type": "library",
"description": "PHPMailer is a full-featured email creation and transfer class for PHP",
"authors": [
{
"name": "Marcus Bointon",
"email": "phpmailer@synchromedia.co.uk"
},
{
"name": "Jim Jagielski",
"email": "jimjag@gmail.com"
},
{
"name": "Andy Prevost",
"email": "codeworxtech@users.sourceforge.net"
},
{
"name": "Brent R. Matzelle"
}
],
"require": {
"php": ">=5.0.0"
},
"require-dev": {
"phpdocumentor/phpdocumentor": "*",
"phpunit/phpunit": "4.7.*"
},
"suggest": {
"league/oauth2-google": "Needed for Google XOAUTH2 authentication"
},
"autoload": {
"classmap": [
"class.phpmailer.php",
"class.phpmaileroauth.php",
"class.phpmaileroauthgoogle.php",
"class.smtp.php",
"class.pop3.php",
"extras/EasyPeasyICS.php",
"extras/ntlm_sasl_client.php"
]
},
"license": "LGPL-2.1"
}
This diff is collapsed.
NEW CALLBACK FUNCTION:
======================
We have had requests for a method to process the results of sending emails
through PHPMailer. In this new release, we have implemented a callback
function that passes the results of each email sent (to, cc, and/or bcc).
We have provided an example that echos the results back to the screen. The
callback function can be used for any purpose. With minor modifications, the
callback function can be used to create CSV logs, post results to databases,
etc.
Please review the test.php script for the example.
It's pretty straight forward.
Enjoy!
Andy
CREATE DKIM KEYS and DNS Resource Record:
=========================================
To create DomainKeys Identified Mail keys, visit:
http://dkim.worxware.com/
... read the information, fill in the form, and download the ZIP file
containing the public key, private key, DNS Resource Record and instructions
to add to your DNS Zone Record, and the PHPMailer code to enable DKIM
digital signing.
/*** PROTECT YOUR PRIVATE & PUBLIC KEYS ***/
You need to protect your DKIM private and public keys from being viewed or
accessed. Add protection to your .htaccess file as in this example:
# secure htkeyprivate file
<Files .htkeyprivate>
order allow,deny
deny from all
</Files>
# secure htkeypublic file
<Files .htkeypublic>
order allow,deny
deny from all
</Files>
(the actual .htaccess additions are in the ZIP file sent back to you from
http://dkim.worxware.com/
A few notes on using DomainKey Identified Mail (DKIM):
You do not need to use PHPMailer to DKIM sign emails IF:
- you enable DomainKey support and add the DNS resource record
- you use your outbound mail server
If you are a third-party emailer that works on behalf of domain owners to
send their emails from your own server:
- you absolutely have to DKIM sign outbound emails
- the domain owner has to add the DNS resource record to match the
private key, public key, selector, identity, and domain that you create
- use caution with the "selector" ... at least one "selector" will already
exist in the DNS Zone Record of the domain at the domain owner's server
you need to ensure that the "selector" you use is unique
Note: since the IP address will not match the domain owner's DNS Zone record
you can be certain that email providers that validate based on DomainKey will
check the domain owner's DNS Zone record for your DNS resource record. Before
sending out emails on behalf of domain owners, ensure they have entered the
DNS resource record you provided them.
Enjoy!
Andy
PS. if you need additional information about DKIM, please see:
http://www.dkim.org/info/dkim-faq.html
#SMTP Debugging
If you are having problems connecting or sending emails through your SMTP server, the SMTP class can provide more information about the processing/errors taking place.
Use the debug functionality of the class to see what's going on in your connections. To do that, set the debug level in your script. For example:
```php
$mail->SMTPDebug = 2;
$mail->isSMTP(); // tell the class to use SMTP
$mail->SMTPAuth = true; // enable SMTP authentication
$mail->Port = 25; // set the SMTP port
$mail->Host = "mail.yourhost.com"; // SMTP server
$mail->Username = "name@yourhost.com"; // SMTP account username
$mail->Password = "your password"; // SMTP account password
```
##Debug levels
Setting the `SMTPDebug` property results in different amounts of output:
* `0`: Disable debugging (you can also leave this out completely, 0 is the default).
* `1`: Output messages sent by the client.
* `2`: as 1, plus responses received from the server (this is probably the most useful setting for debugging).
* `3`: as 2, plus more information about the initial connection.
* `4`: as 3, plus even lower-level information, very verbose.
You don't need to use levels above 2 unless you're having trouble connecting at all - it will just make output more verbose and more difficult to read.
Note that you will get no output until you call `send()`, because no SMTP conversation takes place until you do that.
##Debug output format
The form that the debug output taks is determined by the `Debugoutput` property. This has several options:
* `echo` Output plain-text as-is, appropriate for CLI