mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-11-08 23:43:32 -05:00
jekkosandobjecttothis
260483d436
The valid_path_strict() regex previously allowed space characters, permitting values like '/bin/sh -c id' to pass validation. When passed to CodeIgniter's popen() sink, the shell interprets the space as an argument separator, enabling arbitrary command execution. Remove space from the allowed character set. Legitimate sendmail paths (/usr/sbin/sendmail, C:\wamp64\bin\sendmail\sendmail.exe) do not contain spaces. Update existing tests and add regression cases for shell -c payloads. --------- Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
122 lines
3.6 KiB
PHP
122 lines
3.6 KiB
PHP
<?php
|
|
|
|
namespace app\Libraries;
|
|
|
|
use CodeIgniter\Email\Email;
|
|
use CodeIgniter\Encryption\Encryption;
|
|
use CodeIgniter\Encryption\EncrypterInterface;
|
|
use CodeIgniter\Encryption\Exceptions\EncryptionException;
|
|
use Config\OSPOS;
|
|
use Config\Services;
|
|
|
|
|
|
/**
|
|
* Email library
|
|
*
|
|
* Library with utilities to configure and send emails
|
|
*/
|
|
|
|
class Email_lib
|
|
{
|
|
private Email $email;
|
|
private array $config;
|
|
|
|
public function __construct()
|
|
{
|
|
$this->email = new Email();
|
|
$this->config = config(OSPOS::class)->settings;
|
|
|
|
$encrypter = Services::encrypter();
|
|
|
|
$smtp_pass = $this->config['smtp_pass'] ?? '';
|
|
if (!empty($smtp_pass) && checkEncryption()) {
|
|
try {
|
|
$smtp_pass = $encrypter->decrypt($smtp_pass);
|
|
} catch (\EncryptionException $e) {
|
|
// Decryption failed, use the original value
|
|
log_message('error', 'SMTP password decryption failed: ' . $e->getMessage());
|
|
$smtp_pass = '';
|
|
}
|
|
|
|
}
|
|
|
|
$email_config = [
|
|
'mailType' => 'html',
|
|
'userAgent' => 'OSPOS',
|
|
'validate' => true,
|
|
'protocol' => $this->config['protocol'] ?? 'mail',
|
|
'mailPath' => escapeshellarg($this->config['mailpath'] ?? '/usr/sbin/sendmail'),
|
|
'SMTPHost' => $this->config['smtp_host'] ?? '',
|
|
'SMTPUser' => $this->config['smtp_user'] ?? '',
|
|
'SMTPPass' => $smtp_pass,
|
|
'SMTPPort' => (int)(!empty($this->config['smtp_port']) ? $this->config['smtp_port'] : 465),
|
|
'SMTPTimeout' => (int)(!empty($this->config['smtp_timeout']) ? $this->config['smtp_timeout'] : 5),
|
|
'SMTPCrypto' => $this->config['smtp_crypto'] ?? 'ssl'
|
|
];
|
|
$this->email->initialize($email_config);
|
|
}
|
|
|
|
/**
|
|
* Email sending function
|
|
* Example of use: $response = sendEmail('john@doe.com', 'Hello', 'This is a message', $filename);
|
|
*/
|
|
public function sendEmail(string $to, string $subject, string $message, ?string $attachment = null): bool
|
|
{
|
|
$email = $this->email;
|
|
|
|
$email->setFrom($this->config['email'], $this->config['company']);
|
|
$email->setTo($to);
|
|
$email->setSubject($subject);
|
|
$email->setMessage($message);
|
|
|
|
if (!empty($attachment)) {
|
|
$email->attach($attachment);
|
|
$email->setAttachmentCID($attachment);
|
|
}
|
|
|
|
$result = $email->send();
|
|
|
|
if (!$result) {
|
|
log_message('error', $email->printDebugger());
|
|
}
|
|
|
|
return $result;
|
|
}
|
|
|
|
/**
|
|
* Gets the mime type of the company logo file.
|
|
*
|
|
* @return string Mime type or empty string if logo doesn't exist
|
|
*/
|
|
public function getLogoMimeType(): string
|
|
{
|
|
$logo_path = FCPATH . 'uploads/' . $this->config['company_logo'];
|
|
|
|
if (!empty($this->config['company_logo']) && file_exists($logo_path)) {
|
|
$mimeType = mime_content_type($logo_path);
|
|
return $mimeType !== false ? $mimeType : '';
|
|
}
|
|
|
|
return '';
|
|
}
|
|
|
|
/**
|
|
* Builds an img tag for the company logo to use in email templates.
|
|
*
|
|
* @return string HTML img tag with base64-encoded logo, or empty string if no logo
|
|
*/
|
|
public function buildLogoImgTag(): string
|
|
{
|
|
$mimeType = $this->getLogoMimeType();
|
|
|
|
if ($mimeType === '') {
|
|
return '';
|
|
}
|
|
|
|
$logo_path = FCPATH . 'uploads/' . $this->config['company_logo'];
|
|
$logo_data = base64_encode(file_get_contents($logo_path));
|
|
|
|
return '<img id="image" src="data:' . $mimeType . ';base64,' . $logo_data . '" alt="company_logo">';
|
|
}
|
|
}
|