php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #37109 imap_header - malicious processing of multiple 'from'-headers
Submitted: 2006-04-17 17:43 UTC Modified: 2006-04-18 00:09 UTC
From: oliver dot block at lycos dot de Assigned:
Status: Not a bug Package: IMAP related
PHP Version: 5.1.2 OS: Unix
Private report: No CVE-ID: None
View Developer Edit
 [2006-04-17 17:43 UTC] oliver dot block at lycos dot de 
Description:
------------
When someone send mail with multiple from-header containing mulitple mailboxes, for example:

From: name1 <mbox1@hotmail.com>, name2 <mbox2@yahoo.com>, name3 <mbox3@web.de>

the function imap_header() (maybe others too) should keep this edresses in the from-field.

Unfortunately the imap_function does not keep this data in the from-field, but in the _sender_ field.

The same is applicable to fromaddress and senderaddress fields!

Reproduce code:
---------------
<?php
$stream = imap_open($server,$username,$password);

$header = imap_header($stream, $msgno); 
// $msgno is a valid message no to a message with multiple mailboxes in 'From:' header field 

print "<html><head><head><body><pre>";
print_r($header);
print "</pre></body></html>";

imap_close($stream);

?>

Expected result:
----------------
    [from] => Array
             [0] => stdClass Object
                (
                    [personal] => name1
                    [mailbox] => mbox1
                    [host] => hotmail.com
                )

            [1] => stdClass Object
                (
                    [personal] => name2
                    [mailbox] => mbox2
                    [host] => yahoo.com
                )

            [2] => stdClass Object
                (
                    [personal] => name3
                    [mailbox] => mbox3
                    [host] => web.de
                )


Actual result:
--------------
    [sender] => Array
             [0] => stdClass Object
                (
                    [personal] => name1
                    [mailbox] => mbox1
                    [host] => hotmail.com
                )

            [1] => stdClass Object
                (
                    [personal] => name2
                    [mailbox] => mbox2
                    [host] => yahoo.com
                )

            [2] => stdClass Object
                (
                    [personal] => name3
                    [mailbox] => mbox3
                    [host] => web.de
                )

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-04-17 20:19 UTC] oliver dot block at lycos dot de 
imap_rfc822_parse_headers does deliver the correct _from_ 
field.
 [2006-04-17 23:00 UTC] iliaa@php.net 
Sorry, but your problem does not imply a bug in PHP itself.  For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system is not the
appropriate forum for asking support questions.  Due to the volume
of reports we can not explain in detail here why your report is not
a bug.  The support channels will be able to provide an explanation
for you.

Thank you for your interest in PHP.

The function what the imap library returns, PHP has nothing 
with how the data is parsed internally.
 [2006-04-18 00:09 UTC] oliver dot block at lycos dot de 
I don't know, if I do understand you correctly. You mean 
the c-client library returns that (wrong) data? 
 
What about the data in imap_rcf822_parse_headers?
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Tue Oct 28 02:00:01 2025 UTC