diff options
| author | Stanislav Malyshev <stas@php.net> | 2018-11-20 11:19:51 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2018-11-20 11:20:45 -0800 |
| commit | 63973d1b3384c236cf8576ba46deb55c0a1dc7ad (patch) | |
| tree | 47d3306f05050506ea1f740ccd4be6ca0a682a33 | |
| parent | 44b08a98029b4939200ebf774775461bc19fa608 (diff) | |
| parent | 336d2086a9189006909ae06c7e95902d7d5ff77e (diff) | |
| download | php-git-63973d1b3384c236cf8576ba46deb55c0a1dc7ad.tar.gz | |
Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
Disable rsh/ssh functionality in imap by default (bug #77153)
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | UPGRADING | 6 |
2 files changed, 10 insertions, 0 deletions
@@ -15,6 +15,10 @@ PHP NEWS . Fixed bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR). (cmb) +- IMAP: + . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via + mailbox parameter). (Stas) + - MBstring: . Fixed bug #77165 (mb_check_encoding crashes when argument given an empty array). (Nikita) @@ -112,6 +112,12 @@ BCMath: . bcmul() and bcpow() now return numbers with the requested scale. Formerly, the returned numbers may have omitted trailing decimal zeroes. +IMAP: + rsh/ssh logins are disabled by default. Use imap.enable_insecure_rsh if you want + to enable them. Note that the IMAP library does not filter mailbox names before + passing them to rsh/ssh command, thus passing untrusted data to this function + with rsh/ssh enabled is insecure. + MBString: . Due to added support for named captures, mb_ereg_*() patterns using named captures will behave differently. In particular named captures will be part |