1 /*
2 +----------------------------------------------------------------------+
3 | Copyright (c) The PHP Group |
4 +----------------------------------------------------------------------+
5 | This source file is subject to version 3.01 of the PHP license, |
6 | that is bundled with this package in the file LICENSE, and is |
7 | available through the world-wide-web at the following url: |
8 | https://www.php.net/license/3_01.txt |
9 | If you did not receive a copy of the PHP license and are unable to |
10 | obtain it through the world-wide-web, please send a note to |
11 | license@php.net so we can mail you a copy immediately. |
12 +----------------------------------------------------------------------+
13 | Author: Rasmus Lerdorf <rasmus@php.net> |
14 +----------------------------------------------------------------------+
15 */
16
17 #include <stdlib.h>
18 #include <ctype.h>
19 #include <stdio.h>
20 #include <time.h>
21 #include "php.h"
22 #include "ext/standard/info.h"
23 #include "ext/standard/php_string.h"
24 #include "ext/standard/basic_functions.h"
25 #include "ext/date/php_date.h"
26 #include "zend_smart_str.h"
27
28 #if HAVE_SYSEXITS_H
29 #include <sysexits.h>
30 #endif
31 #if HAVE_SYS_SYSEXITS_H
32 #include <sys/sysexits.h>
33 #endif
34
35 #if PHP_SIGCHILD
36 #include <signal.h>
37 #endif
38
39 #include "php_syslog.h"
40 #include "php_mail.h"
41 #include "php_ini.h"
42 #include "php_string.h"
43 #include "exec.h"
44
45 #ifdef PHP_WIN32
46 #include "win32/sendmail.h"
47 #endif
48
49 #define SKIP_LONG_HEADER_SEP(str, pos) \
50 if (str[pos] == '\r' && str[pos + 1] == '\n' && (str[pos + 2] == ' ' || str[pos + 2] == '\t')) { \
51 pos += 2; \
52 while (str[pos + 1] == ' ' || str[pos + 1] == '\t') { \
53 pos++; \
54 } \
55 continue; \
56 } \
57
58 extern zend_long php_getuid(void);
59
php_mail_build_headers_check_field_value(zval * val)60 static bool php_mail_build_headers_check_field_value(zval *val)
61 {
62 size_t len = 0;
63 zend_string *value = Z_STR_P(val);
64
65 /* https://tools.ietf.org/html/rfc2822#section-2.2.1 */
66 /* https://tools.ietf.org/html/rfc2822#section-2.2.3 */
67 while (len < value->len) {
68 if (*(value->val+len) == '\r') {
69 if (value->len - len >= 3
70 && *(value->val+len+1) == '\n'
71 && (*(value->val+len+2) == ' ' || *(value->val+len+2) == '\t')) {
72 len += 3;
73 continue;
74 }
75 return FAILURE;
76 }
77 if (*(value->val+len) == '\0') {
78 return FAILURE;
79 }
80 len++;
81 }
82 return SUCCESS;
83 }
84
85
php_mail_build_headers_check_field_name(zend_string * key)86 static bool php_mail_build_headers_check_field_name(zend_string *key)
87 {
88 size_t len = 0;
89
90 /* https://tools.ietf.org/html/rfc2822#section-2.2 */
91 while (len < key->len) {
92 if (*(key->val+len) < 33 || *(key->val+len) > 126 || *(key->val+len) == ':') {
93 return FAILURE;
94 }
95 len++;
96 }
97 return SUCCESS;
98 }
99
100
101 static void php_mail_build_headers_elems(smart_str *s, zend_string *key, zval *val);
102
php_mail_build_headers_elem(smart_str * s,zend_string * key,zval * val)103 static void php_mail_build_headers_elem(smart_str *s, zend_string *key, zval *val)
104 {
105 switch(Z_TYPE_P(val)) {
106 case IS_STRING:
107 if (php_mail_build_headers_check_field_name(key) != SUCCESS) {
108 zend_value_error("Header name \"%s\" contains invalid characters", ZSTR_VAL(key));
109 return;
110 }
111 if (php_mail_build_headers_check_field_value(val) != SUCCESS) {
112 zend_value_error("Header \"%s\" has invalid format, or contains invalid characters", ZSTR_VAL(key));
113 return;
114 }
115 smart_str_append(s, key);
116 smart_str_appendl(s, ": ", 2);
117 smart_str_appends(s, Z_STRVAL_P(val));
118 smart_str_appendl(s, "\r\n", 2);
119 break;
120 case IS_ARRAY:
121 php_mail_build_headers_elems(s, key, val);
122 break;
123 default:
124 zend_type_error("Header \"%s\" must be of type array|string, %s given", ZSTR_VAL(key), zend_zval_type_name(val));
125 }
126 }
127
128
php_mail_build_headers_elems(smart_str * s,zend_string * key,zval * val)129 static void php_mail_build_headers_elems(smart_str *s, zend_string *key, zval *val)
130 {
131 zend_string *tmp_key;
132 zval *tmp_val;
133
134 ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(val), tmp_key, tmp_val) {
135 if (tmp_key) {
136 zend_type_error("Header \"%s\" must only contain numeric keys, \"%s\" found", ZSTR_VAL(key), ZSTR_VAL(tmp_key));
137 break;
138 }
139 if (Z_TYPE_P(tmp_val) != IS_STRING) {
140 zend_type_error("Header \"%s\" must only contain values of type string, %s found", ZSTR_VAL(key), zend_zval_type_name(tmp_val));
141 break;
142 }
143 php_mail_build_headers_elem(s, key, tmp_val);
144 } ZEND_HASH_FOREACH_END();
145 }
146
147
php_mail_build_headers(HashTable * headers)148 PHPAPI zend_string *php_mail_build_headers(HashTable *headers)
149 {
150 zend_ulong idx;
151 zend_string *key;
152 zval *val;
153 smart_str s = {0};
154
155 ZEND_HASH_FOREACH_KEY_VAL(headers, idx, key, val) {
156 if (!key) {
157 zend_type_error("Header name cannot be numeric, " ZEND_LONG_FMT " given", idx);
158 break;
159 }
160 /* https://tools.ietf.org/html/rfc2822#section-3.6 */
161 if (zend_string_equals_literal_ci(key, "orig-date")) {
162 PHP_MAIL_BUILD_HEADER_CHECK("orig-date", s, key, val);
163 } else if (zend_string_equals_literal_ci(key, "from")) {
164 PHP_MAIL_BUILD_HEADER_CHECK("from", s, key, val);
165 } else if (zend_string_equals_literal_ci(key, "sender")) {
166 PHP_MAIL_BUILD_HEADER_CHECK("sender", s, key, val);
167 } else if (zend_string_equals_literal_ci(key, "reply-to")) {
168 PHP_MAIL_BUILD_HEADER_CHECK("reply-to", s, key, val);
169 } else if (zend_string_equals_literal_ci(key, "to")) {
170 zend_value_error("The additional headers cannot contain the \"To\" header");
171 } else if (zend_string_equals_literal_ci(key, "cc")) {
172 PHP_MAIL_BUILD_HEADER_CHECK("cc", s, key, val);
173 } else if (zend_string_equals_literal_ci(key, "bcc")) {
174 PHP_MAIL_BUILD_HEADER_CHECK("bcc", s, key, val);
175 } else if (zend_string_equals_literal_ci(key, "message-id")) {
176 PHP_MAIL_BUILD_HEADER_CHECK("message-id", s, key, val);
177 } else if (zend_string_equals_literal_ci(key, "references")) {
178 PHP_MAIL_BUILD_HEADER_CHECK("references", s, key, val);
179 } else if (zend_string_equals_literal_ci(key, "in-reply-to")) {
180 PHP_MAIL_BUILD_HEADER_CHECK("in-reply-to", s, key, val);
181 } else if (zend_string_equals_literal_ci(key, "subject")) {
182 zend_value_error("The additional headers cannot contain the \"Subject\" header");
183 } else {
184 PHP_MAIL_BUILD_HEADER_DEFAULT(s, key, val);
185 }
186
187 if (EG(exception)) {
188 smart_str_free(&s);
189 return NULL;
190 }
191 } ZEND_HASH_FOREACH_END();
192
193 /* Remove the last \r\n */
194 if (s.s) s.s->len -= 2;
195 smart_str_0(&s);
196
197 return s.s;
198 }
199
200
201 /* {{{ Send an email message */
PHP_FUNCTION(mail)202 PHP_FUNCTION(mail)
203 {
204 char *to=NULL, *message=NULL;
205 char *subject=NULL;
206 zend_string *extra_cmd=NULL;
207 zend_string *headers_str = NULL;
208 HashTable *headers_ht = NULL;
209 size_t to_len, message_len;
210 size_t subject_len, i;
211 char *force_extra_parameters = INI_STR("mail.force_extra_parameters");
212 char *to_r, *subject_r;
213
214 ZEND_PARSE_PARAMETERS_START(3, 5)
215 Z_PARAM_PATH(to, to_len)
216 Z_PARAM_PATH(subject, subject_len)
217 Z_PARAM_PATH(message, message_len)
218 Z_PARAM_OPTIONAL
219 Z_PARAM_ARRAY_HT_OR_STR(headers_ht, headers_str)
220 Z_PARAM_PATH_STR(extra_cmd)
221 ZEND_PARSE_PARAMETERS_END();
222
223 if (headers_str) {
224 if (strlen(ZSTR_VAL(headers_str)) != ZSTR_LEN(headers_str)) {
225 zend_argument_value_error(4, "must not contain any null bytes");
226 RETURN_THROWS();
227 }
228 headers_str = php_trim(headers_str, NULL, 0, 2);
229 } else if (headers_ht) {
230 headers_str = php_mail_build_headers(headers_ht);
231 if (EG(exception)) {
232 RETURN_THROWS();
233 }
234 }
235
236 if (to_len > 0) {
237 to_r = estrndup(to, to_len);
238 for (; to_len; to_len--) {
239 if (!isspace((unsigned char) to_r[to_len - 1])) {
240 break;
241 }
242 to_r[to_len - 1] = '\0';
243 }
244 for (i = 0; to_r[i]; i++) {
245 if (iscntrl((unsigned char) to_r[i])) {
246 /* According to RFC 822, section 3.1.1 long headers may be separated into
247 * parts using CRLF followed at least one linear-white-space character ('\t' or ' ').
248 * To prevent these separators from being replaced with a space, we use the
249 * SKIP_LONG_HEADER_SEP to skip over them. */
250 SKIP_LONG_HEADER_SEP(to_r, i);
251 to_r[i] = ' ';
252 }
253 }
254 } else {
255 to_r = to;
256 }
257
258 if (subject_len > 0) {
259 subject_r = estrndup(subject, subject_len);
260 for (; subject_len; subject_len--) {
261 if (!isspace((unsigned char) subject_r[subject_len - 1])) {
262 break;
263 }
264 subject_r[subject_len - 1] = '\0';
265 }
266 for (i = 0; subject_r[i]; i++) {
267 if (iscntrl((unsigned char) subject_r[i])) {
268 SKIP_LONG_HEADER_SEP(subject_r, i);
269 subject_r[i] = ' ';
270 }
271 }
272 } else {
273 subject_r = subject;
274 }
275
276 if (force_extra_parameters) {
277 extra_cmd = php_escape_shell_cmd(force_extra_parameters);
278 } else if (extra_cmd) {
279 extra_cmd = php_escape_shell_cmd(ZSTR_VAL(extra_cmd));
280 }
281
282 if (php_mail(to_r, subject_r, message, headers_str && ZSTR_LEN(headers_str) ? ZSTR_VAL(headers_str) : NULL, extra_cmd ? ZSTR_VAL(extra_cmd) : NULL)) {
283 RETVAL_TRUE;
284 } else {
285 RETVAL_FALSE;
286 }
287
288 if (headers_str) {
289 zend_string_release_ex(headers_str, 0);
290 }
291
292 if (extra_cmd) {
293 zend_string_release_ex(extra_cmd, 0);
294 }
295 if (to_r != to) {
296 efree(to_r);
297 }
298 if (subject_r != subject) {
299 efree(subject_r);
300 }
301 }
302 /* }}} */
303
304
php_mail_log_crlf_to_spaces(char * message)305 void php_mail_log_crlf_to_spaces(char *message) {
306 /* Find all instances of carriage returns or line feeds and
307 * replace them with spaces. Thus, a log line is always one line
308 * long
309 */
310 char *p = message;
311 while ((p = strpbrk(p, "\r\n"))) {
312 *p = ' ';
313 }
314 }
315
php_mail_log_to_syslog(char * message)316 void php_mail_log_to_syslog(char *message) {
317 /* Write 'message' to syslog. */
318 #ifdef HAVE_SYSLOG_H
319 php_syslog(LOG_NOTICE, "%s", message);
320 #endif
321 }
322
323
php_mail_log_to_file(char * filename,char * message,size_t message_size)324 void php_mail_log_to_file(char *filename, char *message, size_t message_size) {
325 /* Write 'message' to the given file. */
326 uint32_t flags = REPORT_ERRORS | STREAM_DISABLE_OPEN_BASEDIR;
327 php_stream *stream = php_stream_open_wrapper(filename, "a", flags, NULL);
328 if (stream) {
329 php_stream_write(stream, message, message_size);
330 php_stream_close(stream);
331 }
332 }
333
334
php_mail_detect_multiple_crlf(const char * hdr)335 static int php_mail_detect_multiple_crlf(const char *hdr) {
336 /* This function detects multiple/malformed multiple newlines. */
337
338 if (!hdr || !strlen(hdr)) {
339 return 0;
340 }
341
342 /* Should not have any newlines at the beginning. */
343 /* RFC 2822 2.2. Header Fields */
344 if (*hdr < 33 || *hdr > 126 || *hdr == ':') {
345 return 1;
346 }
347
348 while(*hdr) {
349 if (*hdr == '\r') {
350 if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\0' || *(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
351 /* Malformed or multiple newlines. */
352 return 1;
353 } else {
354 hdr += 2;
355 }
356 } else if (*hdr == '\n') {
357 if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || *(hdr+1) == '\n') {
358 /* Malformed or multiple newlines. */
359 return 1;
360 } else {
361 hdr += 2;
362 }
363 } else {
364 hdr++;
365 }
366 }
367
368 return 0;
369 }
370
371
372 /* {{{ php_mail */
php_mail(const char * to,const char * subject,const char * message,const char * headers,const char * extra_cmd)373 PHPAPI int php_mail(const char *to, const char *subject, const char *message, const char *headers, const char *extra_cmd)
374 {
375 #ifdef PHP_WIN32
376 int tsm_err;
377 char *tsm_errmsg = NULL;
378 #endif
379 FILE *sendmail;
380 int ret;
381 char *sendmail_path = INI_STR("sendmail_path");
382 char *sendmail_cmd = NULL;
383 char *mail_log = INI_STR("mail.log");
384 const char *hdr = headers;
385 char *ahdr = NULL;
386 #if PHP_SIGCHILD
387 void (*sig_handler)() = NULL;
388 #endif
389
390 #define MAIL_RET(val) \
391 if (ahdr != NULL) { \
392 efree(ahdr); \
393 } \
394 return val; \
395
396 if (mail_log && *mail_log) {
397 char *logline;
398
399 spprintf(&logline, 0, "mail() on [%s:%d]: To: %s -- Headers: %s -- Subject: %s", zend_get_executed_filename(), zend_get_executed_lineno(), to, hdr ? hdr : "", subject);
400
401 if (hdr) {
402 php_mail_log_crlf_to_spaces(logline);
403 }
404
405 if (!strcmp(mail_log, "syslog")) {
406 php_mail_log_to_syslog(logline);
407 } else {
408 /* Add date when logging to file */
409 char *tmp;
410 time_t curtime;
411 zend_string *date_str;
412 size_t len;
413
414
415 time(&curtime);
416 date_str = php_format_date("d-M-Y H:i:s e", 13, curtime, 1);
417 len = spprintf(&tmp, 0, "[%s] %s%s", date_str->val, logline, PHP_EOL);
418
419 php_mail_log_to_file(mail_log, tmp, len);
420
421 zend_string_free(date_str);
422 efree(tmp);
423 }
424
425 efree(logline);
426 }
427
428 if (PG(mail_x_header)) {
429 const char *tmp = zend_get_executed_filename();
430 zend_string *f;
431
432 f = php_basename(tmp, strlen(tmp), NULL, 0);
433
434 if (headers != NULL && *headers) {
435 spprintf(&ahdr, 0, "X-PHP-Originating-Script: " ZEND_LONG_FMT ":%s\r\n%s", php_getuid(), ZSTR_VAL(f), headers);
436 } else {
437 spprintf(&ahdr, 0, "X-PHP-Originating-Script: " ZEND_LONG_FMT ":%s", php_getuid(), ZSTR_VAL(f));
438 }
439 hdr = ahdr;
440 zend_string_release_ex(f, 0);
441 }
442
443 if (hdr && php_mail_detect_multiple_crlf(hdr)) {
444 php_error_docref(NULL, E_WARNING, "Multiple or malformed newlines found in additional_header");
445 MAIL_RET(0);
446 }
447
448 if (!sendmail_path) {
449 #ifdef PHP_WIN32
450 /* handle old style win smtp sending */
451 if (TSendMail(INI_STR("SMTP"), &tsm_err, &tsm_errmsg, hdr, subject, to, message, NULL, NULL, NULL) == FAILURE) {
452 if (tsm_errmsg) {
453 php_error_docref(NULL, E_WARNING, "%s", tsm_errmsg);
454 efree(tsm_errmsg);
455 } else {
456 php_error_docref(NULL, E_WARNING, "%s", GetSMErrorText(tsm_err));
457 }
458 MAIL_RET(0);
459 }
460 MAIL_RET(1);
461 #else
462 MAIL_RET(0);
463 #endif
464 }
465 if (extra_cmd != NULL) {
466 spprintf(&sendmail_cmd, 0, "%s %s", sendmail_path, extra_cmd);
467 } else {
468 sendmail_cmd = sendmail_path;
469 }
470
471 #if PHP_SIGCHILD
472 /* Set signal handler of SIGCHLD to default to prevent other signal handlers
473 * from being called and reaping the return code when our child exits.
474 * The original handler needs to be restored after pclose() */
475 sig_handler = (void *)signal(SIGCHLD, SIG_DFL);
476 if (sig_handler == SIG_ERR) {
477 sig_handler = NULL;
478 }
479 #endif
480
481 #ifdef PHP_WIN32
482 sendmail = popen_ex(sendmail_cmd, "wb", NULL, NULL);
483 #else
484 /* Since popen() doesn't indicate if the internal fork() doesn't work
485 * (e.g. the shell can't be executed) we explicitly set it to 0 to be
486 * sure we don't catch any older errno value. */
487 errno = 0;
488 sendmail = popen(sendmail_cmd, "w");
489 #endif
490 if (extra_cmd != NULL) {
491 efree (sendmail_cmd);
492 }
493
494 if (sendmail) {
495 #ifndef PHP_WIN32
496 if (EACCES == errno) {
497 php_error_docref(NULL, E_WARNING, "Permission denied: unable to execute shell to run mail delivery binary '%s'", sendmail_path);
498 pclose(sendmail);
499 #if PHP_SIGCHILD
500 /* Restore handler in case of error on Windows
501 Not sure if this applicable on Win but just in case. */
502 if (sig_handler) {
503 signal(SIGCHLD, sig_handler);
504 }
505 #endif
506 MAIL_RET(0);
507 }
508 #endif
509 fprintf(sendmail, "To: %s\r\n", to);
510 fprintf(sendmail, "Subject: %s\r\n", subject);
511 if (hdr != NULL) {
512 fprintf(sendmail, "%s\r\n", hdr);
513 }
514 fprintf(sendmail, "\r\n%s\r\n", message);
515 ret = pclose(sendmail);
516
517 #if PHP_SIGCHILD
518 if (sig_handler) {
519 signal(SIGCHLD, sig_handler);
520 }
521 #endif
522
523 #ifdef PHP_WIN32
524 if (ret == -1)
525 #else
526 #if defined(EX_TEMPFAIL)
527 if ((ret != EX_OK)&&(ret != EX_TEMPFAIL))
528 #elif defined(EX_OK)
529 if (ret != EX_OK)
530 #else
531 if (ret != 0)
532 #endif
533 #endif
534 {
535 MAIL_RET(0);
536 } else {
537 MAIL_RET(1);
538 }
539 } else {
540 php_error_docref(NULL, E_WARNING, "Could not execute mail delivery program '%s'", sendmail_path);
541 #if PHP_SIGCHILD
542 if (sig_handler) {
543 signal(SIGCHLD, sig_handler);
544 }
545 #endif
546 MAIL_RET(0);
547 }
548
549 MAIL_RET(1); /* never reached */
550 }
551 /* }}} */
552
553 /* {{{ PHP_MINFO_FUNCTION */
PHP_MINFO_FUNCTION(mail)554 PHP_MINFO_FUNCTION(mail)
555 {
556 char *sendmail_path = INI_STR("sendmail_path");
557
558 #ifdef PHP_WIN32
559 if (!sendmail_path) {
560 php_info_print_table_row(2, "Internal Sendmail Support for Windows", "enabled");
561 } else {
562 php_info_print_table_row(2, "Path to sendmail", sendmail_path);
563 }
564 #else
565 php_info_print_table_row(2, "Path to sendmail", sendmail_path);
566 #endif
567 }
568 /* }}} */
569