From 9fd02a4f11881b3e0e1b3029c7c9e85a799c5ced Mon Sep 17 00:00:00 2001
From: Brion Vibber <brion@pobox.com>
Date: Fri, 30 Apr 2010 13:47:46 -0700
Subject: Update PEAR::Mail to 1.2.0 release; fixes deprecation warnings
 running under PHP 5.3.

---
 extlib/Mail/sendmail.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)
 mode change 100644 => 100755 extlib/Mail/sendmail.php

(limited to 'extlib/Mail/sendmail.php')

diff --git a/extlib/Mail/sendmail.php b/extlib/Mail/sendmail.php
old mode 100644
new mode 100755
index cd248e61d..b056575e9
--- a/extlib/Mail/sendmail.php
+++ b/extlib/Mail/sendmail.php
@@ -20,7 +20,7 @@
  * Sendmail implementation of the PEAR Mail:: interface.
  * @access public
  * @package Mail
- * @version $Revision: 1.19 $
+ * @version $Revision: 294744 $
  */
 class Mail_sendmail extends Mail {
 
@@ -117,7 +117,7 @@ class Mail_sendmail extends Mail {
         if (is_a($recipients, 'PEAR_Error')) {
             return $recipients;
         }
-        $recipients = escapeShellCmd(implode(' ', $recipients));
+        $recipients = implode(' ', array_map('escapeshellarg', $recipients));
 
         $headerElements = $this->prepareHeaders($headers);
         if (is_a($headerElements, 'PEAR_Error')) {
@@ -141,7 +141,8 @@ class Mail_sendmail extends Mail {
             return PEAR::raiseError('From address specified with dangerous characters.');
         }
 
-        $from = escapeShellCmd($from);
+        $from = escapeshellarg($from); // Security bug #16200
+
         $mail = @popen($this->sendmail_path . (!empty($this->sendmail_args) ? ' ' . $this->sendmail_args : '') . " -f$from -- $recipients", 'w');
         if (!$mail) {
             return PEAR::raiseError('Failed to open sendmail [' . $this->sendmail_path . '] for execution.');
-- 
cgit v1.2.3-54-g00ecf