开发者

Sending fpdf attachments does not work on my linux suse server but it does on my shared hosting account

I have a php program i have developed on the internet. So far i have used a shared hosting package. Everything worked until i moved to a vps (apache2 suse 9.1 plesk) . I have found certain php functions have not been activated. I have solved most of them by using the internet.

My main problem is emailing pdfs with fpdf. i.e

<?php
// download fpdf class (http://fpdf.org)
require("fpdf.php");

// fpdf object
$pdf = new FPDF();

// generate a simple PDF (for more info, see http://fpdf.org/en/tutorial/)
$pdf->AddPage();
$pdf->SetFont("Arial","B",14);
$pdf->Cell(40,10, "this is a pdf example");

// email stuff (change data below)
$to = "steven@siteaddress.co.uk"; 
$from = "me@domain.com"; 
$subject = "send email with pdf attachment"; 
$message = "<p>Please see the attachment.</p>";

// a random hash will be necessary to send mixed content
$separator = md5(time());

// carriage return type (we use a PHP end of line constant)
$eol = PHP_EOL;

// attachment name
$filename = "开发者_运维问答example.pdf";

// encode data (puts attachment in proper format)
$pdfdoc = $pdf->Output("", "S");
$attachment = chunk_split(base64_encode($pdfdoc));


// main header (multipart mandatory)
$headers  = "From: ".$from.$eol;
$headers .= "MIME-Version: 1.0".$eol; 
$headers .= "Content-Type: multipart/mixed; boundary=\"".$separator."\"".$eol.$eol; 
$headers .= "Content-Transfer-Encoding: 7bit".$eol;
$headers .= "This is a MIME encoded message.".$eol.$eol;

// message
$headers .= "--".$separator.$eol;
$headers .= "Content-Type: text/html; charset=\"iso-8859-1\"".$eol;
$headers .= "Content-Transfer-Encoding: 8bit".$eol.$eol;
$headers .= $message.$eol.$eol;

// attachment
$headers .= "--".$separator.$eol;
$headers .= "Content-Type: application/octet-stream; name=\"".$filename."\"".$eol; 
$headers .= "Content-Transfer-Encoding: base64".$eol;
$headers .= "Content-Disposition: attachment".$eol.$eol;
$headers .= $attachment.$eol.$eol;
$headers .= "--".$separator."--";

// send message
//mail($to, $subject, "", $headers);
if (@mail($to, $subject, "",$headers)) {  
 echo('<p>Mail sent successfully.</p>');  
} else {  
 echo('<p>Mail could not be sent.</p>');  
}  

?>

The file above works on my share hosting , but when it comes to sending from my vps i get this error message from my file

Mar 23 19:16:56 h1871885 suhosin[64630]: ALERT - mail() - double newline in headers, possible injection, mail dropped (attacker '86.137.40.199', file '/srv/www/vhosts/sitename.co.uk/httpdocs/main/email.php', line 111)

after much trial, the error is from this line

 if (@mail($to, $subject, "",$headers))

If i remove the "", it sends the email on my vps but there is no attachment. this also happens on my shared account. The attachment ends up in the message with a hole load of chars'. So i def need them in there. does anyone have a clue how to overcome this problem.

many thanks

after setting suhosin.ini to 0

Mar 23 20:52:48 h1871885 suhosin[60778]: ALERT - mail() - double newline in headers, possible injection, mail dropped (attacker '86.137.40.199', file '/srv/www/vhosts/sitename.co.uk/httpdocs/main/email1.php', line 56)


You have an awful lot of .$eol.$eol in your $headers, and I imagine suhosin is forbidding the mail on the second instance. But I presume you've looked enough at RFC2822 to know exactly where you need blank lines in your message formatting, so you can turn off suhosin's mail() protection, assuming you're confident that you don't have any remotely exploitable injection vulnerabilities.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜