I'm in the process of upgrading 1.3.7 --> 1.3.8a.
I found change that I've made to includes/classes/class.phpmailer.php
I can't tell if the fix is in the newer version.Code:/*** SA 08-08-07 PHPMailer vulnerability patch (old code commented below) ***/ function SendmailSend($header, $body) { if ($this->Sender != "") { $sendmail = sprintf("%s -oi -f %s -t", escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender)); } else { $sendmail = sprintf("%s -oi -t", escapeshellcmd($this->Sendmail)); } /* function SendmailSend($header, $body) { if ($this->Sender != "") $sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender); else $sendmail = sprintf("%s -oi -t", $this->Sendmail); */
Please someone let me know.
s.ali



