From b59e7cb786ae90f9d98ef87fd255d02e32f4241c Mon Sep 17 00:00:00 2001 From: Michael M Slusarz Date: Thu, 13 Jan 2011 12:03:16 -0700 Subject: [PATCH] Bug #9509: Don't sanitize raw header text --- framework/Mail/lib/Horde/Mail/Transport.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/framework/Mail/lib/Horde/Mail/Transport.php b/framework/Mail/lib/Horde/Mail/Transport.php index 4ecfe236c..1b6538ae8 100644 --- a/framework/Mail/lib/Horde/Mail/Transport.php +++ b/framework/Mail/lib/Horde/Mail/Transport.php @@ -201,16 +201,19 @@ abstract class Horde_Mail_Transport * strings present in a legitimate header's value. The goal of this * filter is to prevent mail injection attacks. * + * Raw headers are sent as-is. + * * @param array $headers The associative array of headers to sanitize. * * @return array The sanitized headers. */ protected function _sanitizeHeaders($headers) { - foreach (array_keys($headers) as $key) { + foreach (array_diff(array_keys($headers), array('_raw')) as $key) { $headers[$key] = preg_replace('=((||0x0A/%0A|0x0D/%0D|\\n|\\r)\S).*=i', null, $headers[$key]); } return $headers; } + } -- 2.11.0