mirror of
https://github.com/php/php-src.git
synced 2026-04-30 03:33:17 +02:00
George Peter Banyard
d17fae8a1c
The script for the clean section was missing the $ Meta-character to only delete the default mailbox when it's an exact match. Reinstore parallel testing for more tests.
25 lines
618 B
PHP
25 lines
618 B
PHP
--TEST--
|
|
Bug #77153 (imap_open allows to run arbitrary shell commands via mailbox parameter)
|
|
--SKIPIF--
|
|
<?php
|
|
extension_loaded('imap') or die('skip imap extension not available in this build');
|
|
?>
|
|
--CONFLICTS--
|
|
defaultmailbox
|
|
--FILE--
|
|
<?php
|
|
$payload = "echo 'BUG'> " . __DIR__ . '/__bug';
|
|
$payloadb64 = base64_encode($payload);
|
|
$server = "x -oProxyCommand=echo\t$payloadb64|base64\t-d|sh}";
|
|
@imap_open('{'.$server.':143/imap}INBOX', '', '');
|
|
// clean
|
|
imap_errors();
|
|
var_dump(file_exists(__DIR__ . '/__bug'));
|
|
?>
|
|
--EXPECT--
|
|
bool(false)
|
|
--CLEAN--
|
|
<?php
|
|
if(file_exists(__DIR__ . '/__bug')) unlink(__DIR__ . '/__bug');
|
|
?>
|