Skip to content

Commit 9972b81

Browse files
ZanarkZanark
authored
Merge pull request #1 from Zanark/phpmailer
Addition of phpMailer
2 parents cf8c489 + e817039 commit 9972b81

File tree

127 files changed

+17557
-9
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

127 files changed

+17557
-9
lines changed

‎LICENSE

Lines changed: 502 additions & 0 deletions
Large diffs are not rendered by default.

‎SECURITY.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Security notices relating to PHPMailer
2+
3+
Please disclose any vulnerabilities found responsibly - report any security problems found to the maintainers privately.
4+
5+
PHPMailer versions prior to 5.2.24 (released July 26th 2017) have an XSS vulnerability in one of the code examples, [CVE-2017-11503](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11503). The `code_generator.phps` example did not filter user input prior to output. This file is distributed with a `.phps` extension, so it it not normally executable unless it is explicitly renamed, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.
6+
7+
PHPMailer versions prior to 5.2.22 (released January 9th 2017) have a local file disclosure vulnerability, [CVE-2017-5223](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5223). If content passed into `msgHTML()` is sourced from unfiltered user input, relative paths can map to absolute local file paths and added as attachments. Also note that `addAttachment` (just like `file_get_contents`, `passthru`, `unlink`, etc) should not be passed user-sourced params either! Reported by Yongxiang Li of Asiasecurity.
8+
9+
PHPMailer versions prior to 5.2.20 (released December 28th 2016) are vulnerable to [CVE-2016-10045](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10045) a remote code execution vulnerability, responsibly reported by [Dawid Golunski](https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html), and patched by Paul Buonopane (@Zenexer).
10+
11+
PHPMailer versions prior to 5.2.18 (released December 2016) are vulnerable to [CVE-2016-10033](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10033) a remote code execution vulnerability, responsibly reported by [Dawid Golunski](http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html).
12+
13+
PHPMailer versions prior to 5.2.14 (released November 2015) are vulnerable to [CVE-2015-8476](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8476) an SMTP CRLF injection bug permitting arbitrary message sending.
14+
15+
PHPMailer versions prior to 5.2.10 (released May 2015) are vulnerable to [CVE-2008-5619](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5619), a remote code execution vulnerability in the bundled html2text library. This file was removed in 5.2.10, so if you are using a version prior to that and make use of the html2text function, it's vitally important that you upgrade and remove this file.
16+
17+
PHPMailer versions prior to 2.0.7 and 2.2.1 are vulnerable to [CVE-2012-0796](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0796), an email header injection attack.
18+
19+
Joomla 1.6.0 uses PHPMailer in an unsafe way, allowing it to reveal local file paths, reported in [CVE-2011-3747](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3747).
20+
21+
PHPMailer didn't sanitise the `$lang_path` parameter in `SetLanguage`. This wasn't a problem in itself, but some apps (PHPClassifieds, ATutor) also failed to sanitise user-provided parameters passed to it, permitting semi-arbitrary local file inclusion, reported in [CVE-2010-4914](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4914), [CVE-2007-2021](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-2021) and [CVE-2006-5734](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5734).
22+
23+
PHPMailer 1.7.2 and earlier contained a possible DDoS vulnerability reported in [CVE-2005-1807](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1807).
24+
25+
PHPMailer 1.7 and earlier (June 2003) have a possible vulnerability in the `SendmailSend` method where shell commands may not be sanitised. Reported in [CVE-2007-3215](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3215).
26+

‎VERSION

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
6.0.3

‎composer.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"autoload": {
3+
"psr-4": {
4+
"Acme\\": "src/"
5+
}
6+
},
7+
"require": {
8+
"phpmailer/phpmailer": "^6.0"
9+
}
10+
}

‎composer.lock

Lines changed: 84 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎contact-us.php

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?php
2+
// Import PHPMailer classes into the global namespace
3+
// These must be at the top of your script, not inside a function
4+
5+
6+
use PHPMailer\PHPMailer\PHPMailer;
7+
use PHPMailer\PHPMailer\Exception;
8+
9+
//Load Composer's autoloader
10+
require 'vendor/autoload.php';
11+
12+
$email_id = $_POST['email'] ;
13+
14+
$mail = new PHPMailer(true); // Passing `true` enables exceptions
15+
try {
16+
//Server settings
17+
$mail->SMTPDebug = 2; // Enable verbose debug output
18+
$mail->isSMTP(); // Set mailer to use SMTP
19+
$mail->Host = 'smtp.gmail.com'; // Specify main and backup SMTP servers
20+
$mail->SMTPAuth = true; // Enable SMTP authentication
21+
$mail->Username = 'college.study.notes@gmail.com'; // SMTP username
22+
$mail->Password = 'noteswalaemail'; // SMTP password
23+
//$mail->SMTPSecure = 'tls'; // Enable TLS encryption, `ssl` also accepted
24+
$mail->Port = 25; // TCP port to connect to
25+
26+
//Recipients
27+
$mail->setFrom('college.study.notes@gmail.com', 'Mailer');
28+
$mail->addAddress($email_id, 'Joe User'); // Add a recipient
29+
$mail->addAddress('kiodeba11@gmail.com'); // Name is optional
30+
//$mail->addReplyTo('info@example.com', 'Information');
31+
//$mail->addCC('cc@example.com');
32+
//$mail->addBCC('bcc@example.com');
33+
34+
//Attachments
35+
//$mail->addAttachment('/var/tmp/file.tar.gz'); // Add attachments
36+
//$mail->addAttachment('/tmp/image.jpg', 'new.jpg'); // Optional name
37+
38+
//Content
39+
$mail->isHTML(true); // Set email format to HTML
40+
$mail->Subject = 'Thank You for Contacting us';
41+
$mail->Body = 'Thanks a ton for sending us a message. We were quite lonely here :D .';
42+
$mail->AltBody = 'Thanks a ton for sending us a message. We were quite lonely here :D .';
43+
44+
$mail->send();
45+
echo 'Message has been sent';
46+
} catch (Exception $e) {
47+
echo 'Message could not be sent. Mailer Error: ', $mail->ErrorInfo;
48+
}
49+
50+

‎get_oauth_token.php

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
<?php
2+
/**
3+
* PHPMailer - PHP email creation and transport class.
4+
* PHP Version 5.5
5+
* @package PHPMailer
6+
* @see https://github.com/PHPMailer/PHPMailer/ The PHPMailer GitHub project
7+
* @author Marcus Bointon (Synchro/coolbru) <phpmailer@synchromedia.co.uk>
8+
* @author Jim Jagielski (jimjag) <jimjag@gmail.com>
9+
* @author Andy Prevost (codeworxtech) <codeworxtech@users.sourceforge.net>
10+
* @author Brent R. Matzelle (original founder)
11+
* @copyright 2012 - 2017 Marcus Bointon
12+
* @copyright 2010 - 2012 Jim Jagielski
13+
* @copyright 2004 - 2009 Andy Prevost
14+
* @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License
15+
* @note This program is distributed in the hope that it will be useful - WITHOUT
16+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17+
* FITNESS FOR A PARTICULAR PURPOSE.
18+
*/
19+
/**
20+
* Get an OAuth2 token from an OAuth2 provider.
21+
* * Install this script on your server so that it's accessible
22+
* as [https/http]://<yourdomain>/<folder>/get_oauth_token.php
23+
* e.g.: http://localhost/phpmailer/get_oauth_token.php
24+
* * Ensure dependencies are installed with 'composer install'
25+
* * Set up an app in your Google/Yahoo/Microsoft account
26+
* * Set the script address as the app's redirect URL
27+
* If no refresh token is obtained when running this file,
28+
* revoke access to your app and run the script again.
29+
*/
30+
31+
namespace PHPMailer\PHPMailer;
32+
33+
/**
34+
* Aliases for League Provider Classes
35+
* Make sure you have added these to your composer.json and run `composer install`
36+
* Plenty to choose from here:
37+
* @see http://oauth2-client.thephpleague.com/providers/thirdparty/
38+
*/
39+
// @see https://github.com/thephpleague/oauth2-google
40+
use League\OAuth2\Client\Provider\Google;
41+
// @see https://packagist.org/packages/hayageek/oauth2-yahoo
42+
use Hayageek\OAuth2\Client\Provider\Yahoo;
43+
// @see https://github.com/stevenmaguire/oauth2-microsoft
44+
use Stevenmaguire\OAuth2\Client\Provider\Microsoft;
45+
46+
if (!isset($_GET['code']) && !isset($_GET['provider'])) {
47+
?>
48+
<html>
49+
<body>Select Provider:<br/>
50+
<a href='?provider=Google'>Google</a><br/>
51+
<a href='?provider=Yahoo'>Yahoo</a><br/>
52+
<a href='?provider=Microsoft'>Microsoft/Outlook/Hotmail/Live/Office365</a><br/>
53+
</body>
54+
</html>
55+
<?php
56+
exit;
57+
}
58+
59+
require 'vendor/autoload.php';
60+
61+
session_start();
62+
63+
$providerName = '';
64+
65+
if (array_key_exists('provider', $_GET)) {
66+
$providerName = $_GET['provider'];
67+
$_SESSION['provider'] = $providerName;
68+
} elseif (array_key_exists('provider', $_SESSION)) {
69+
$providerName = $_SESSION['provider'];
70+
}
71+
if (!in_array($providerName, ['Google', 'Microsoft', 'Yahoo'])) {
72+
exit('Only Google, Microsoft and Yahoo OAuth2 providers are currently supported in this script.');
73+
}
74+
75+
//These details are obtained by setting up an app in the Google developer console,
76+
//or whichever provider you're using.
77+
$clientId = 'RANDOMCHARS-----duv1n2.apps.googleusercontent.com';
78+
$clientSecret = 'RANDOMCHARS-----lGyjPcRtvP';
79+
80+
//If this automatic URL doesn't work, set it yourself manually to the URL of this script
81+
$redirectUri = (isset($_SERVER['HTTPS']) ? 'https://' : 'http://') . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'];
82+
//$redirectUri = 'http://localhost/PHPMailer/redirect';
83+
84+
$params = [
85+
'clientId' => $clientId,
86+
'clientSecret' => $clientSecret,
87+
'redirectUri' => $redirectUri,
88+
'accessType' => 'offline'
89+
];
90+
91+
$options = [];
92+
$provider = null;
93+
94+
switch ($providerName) {
95+
case 'Google':
96+
$provider = new Google($params);
97+
$options = [
98+
'scope' => [
99+
'https://mail.google.com/'
100+
]
101+
];
102+
break;
103+
case 'Yahoo':
104+
$provider = new Yahoo($params);
105+
break;
106+
case 'Microsoft':
107+
$provider = new Microsoft($params);
108+
$options = [
109+
'scope' => [
110+
'wl.imap',
111+
'wl.offline_access'
112+
]
113+
];
114+
break;
115+
}
116+
117+
if (null === $provider) {
118+
exit('Provider missing');
119+
}
120+
121+
if (!isset($_GET['code'])) {
122+
// If we don't have an authorization code then get one
123+
$authUrl = $provider->getAuthorizationUrl($options);
124+
$_SESSION['oauth2state'] = $provider->getState();
125+
header('Location: ' . $authUrl);
126+
exit;
127+
// Check given state against previously stored one to mitigate CSRF attack
128+
} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
129+
unset($_SESSION['oauth2state']);
130+
unset($_SESSION['provider']);
131+
exit('Invalid state');
132+
} else {
133+
unset($_SESSION['provider']);
134+
// Try to get an access token (using the authorization code grant)
135+
$token = $provider->getAccessToken(
136+
'authorization_code',
137+
[
138+
'code' => $_GET['code']
139+
]
140+
);
141+
// Use this to interact with an API on the users behalf
142+
// Use this to get a new access token if the old one expires
143+
echo 'Refresh Token: ', $token->getRefreshToken();
144+
}

‎index.html

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -175,10 +175,10 @@ <h3>Inspiration</h3>
175175
<div class="hire">
176176
<h2>You want us to do</h2>
177177
<!-- checkout formspree.io for easy form setup -->
178-
<form class="work-request">
178+
<form class="work-request" action="contact-us.php" method="POST">
179179
<div class="work-request--options">
180180
<span class="options-a">
181-
<input id="opt-1" value="app design" type="checkbox">
181+
<input id="opt-1" value="app design" type="checkbox" name="job">
182182
<label for="opt-1">
183183
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 150 111" style="enable-background:new 0 0 150 111;" xml:space="preserve">
184184
<g transform="translate(0.000000,111.000000) scale(0.100000,-0.100000)">
@@ -187,7 +187,7 @@ <h2>You want us to do</h2>
187187
</svg>
188188
Android Developers
189189
</label>
190-
<input id="opt-2" value="graphic design" type="checkbox">
190+
<input id="opt-2" value="graphic design" type="checkbox" name="job">
191191
<label for="opt-2">
192192
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 150 111" style="enable-background:new 0 0 150 111;" xml:space="preserve">
193193
<g transform="translate(0.000000,111.000000) scale(0.100000,-0.100000)">
@@ -196,7 +196,7 @@ <h2>You want us to do</h2>
196196
</svg>
197197
Graphic Design
198198
</label>
199-
<input id="opt-3" value="motion design" type="checkbox">
199+
<input id="opt-3" value="motion design" type="checkbox" name="job">
200200
<label for="opt-3">
201201
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 150 111" style="enable-background:new 0 0 150 111;" xml:space="preserve">
202202
<g transform="translate(0.000000,111.000000) scale(0.100000,-0.100000)">
@@ -207,7 +207,7 @@ <h2>You want us to do</h2>
207207
</label>
208208
</span>
209209
<span class="options-b">
210-
<input id="opt-4" value="ux design" type="checkbox">
210+
<input id="opt-4" value="ux design" type="checkbox" name="job">
211211
<label for="opt-4">
212212
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 150 111" style="enable-background:new 0 0 150 111;" xml:space="preserve">
213213
<g transform="translate(0.000000,111.000000) scale(0.100000,-0.100000)">
@@ -216,7 +216,7 @@ <h2>You want us to do</h2>
216216
</svg>
217217
UI &amp; UXDesign
218218
</label>
219-
<input id="opt-5" value="webdesign" type="checkbox">
219+
<input id="opt-5" value="webdesign" type="checkbox" name="job">
220220
<label for="opt-5">
221221
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 150 111" style="enable-background:new 0 0 150 111;" xml:space="preserve">
222222
<g transform="translate(0.000000,111.000000) scale(0.100000,-0.100000)">
@@ -225,7 +225,7 @@ <h2>You want us to do</h2>
225225
</svg>
226226
Webdesign
227227
</label>
228-
<input id="opt-6" value="marketing" type="checkbox">
228+
<input id="opt-6" value="marketing" type="checkbox" name="job">
229229
<label for="opt-6">
230230
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 150 111" style="enable-background:new 0 0 150 111;" xml:space="preserve">
231231
<g transform="translate(0.000000,111.000000) scale(0.100000,-0.100000)">
@@ -238,11 +238,11 @@ <h2>You want us to do</h2>
238238
</div>
239239
<div class="work-request--information">
240240
<div class="information-name">
241-
<input id="name" spellcheck="false" type="text">
241+
<input id="name" spellcheck="false" type="text" name="name">
242242
<label for="name">Name</label>
243243
</div>
244244
<div class="information-email">
245-
<input id="email" spellcheck="false" type="email">
245+
<input id="email" spellcheck="false" type="email" name="email">
246246
<label for="email">Email</label>
247247
</div>
248248
</div>

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy