5

If there is no access to php.ini (assume php -v >= 5.3 & mail.add_x_header = 1), or a way to patch mail, is there a way to change the X-Php-Originating-Script header when using php's mail() function?

The little research I did indicated that altering $_SERVER['PHP_SELF'] prior to calling mail() would do the trick, however this did not work for me.

I also tried setting X-Php-Originating-Script directly, this resulted in an additional 'X-Php-Originating-Script' header.

The goal in this case is to prevent recipients of said email to gleam details on script nomenclature.

Thanks!

Ragamffn
  • 309
  • 1
  • 4
  • 14
  • I downvoted your question for accepting the wrong answer. Please select the answer by Night Owl so people reading your question are finding the info that actually helps them! – Dominique Feb 25 '19 at 10:37
  • 1
    @Dominique Thanks for the heads up! – Ragamffn Mar 01 '19 at 18:14

3 Answers3

13

According to the PHP Manual (PHP Manual >> Function Reference >> Mail Related Extensions >> Mail >> Installing/Configuring) that header can be turned off using php.ini or .htaccess file which would prevent anyone from gleaning information from your mail headers without you having access to your php.ini file.

The setting to turn it off is:

mail.add_x_header bool

Add X-PHP-Originating-Script that will include UID of the script followed by the filename.

which would make the actual line needed to disable it:

 mail.add_x_header 0

This setting is flagged with the PHP_INI_PERDIR mode (Available since PHP 5.3.0). PHP_INI_PERDIR means that the "Entry can be set in php.ini, .htaccess, httpd.conf or .user.ini (since PHP 5.3)."

For .htaccess:

php_flag mail.add_x_header Off

I have not personally tested this so YMMV.

rustyx
  • 80,671
  • 25
  • 200
  • 267
Night Owl
  • 4,198
  • 4
  • 28
  • 37
  • 1
    This does not work in PHP Version 5.3.10-1ubuntu3.11. Too bad. I tried `mail.add_x_header 0` and `mail.add_x_header Off` in .htaccess. Is the syntax different? – Swiss Mister Aug 13 '14 at 07:56
  • 1
    @SwissMister The syntax would be “php_flag mail.add_x_header Off”, ideally wrapped inside an … tag. – Teddy Mar 06 '15 at 09:54
3

Well, if we check out the source code for the mail() function, we can see it's hard-coded in there:

if (headers != NULL) {
    spprintf(&hdr, 0, "X-PHP-Originating-Script: %ld:%s\n%s", php_getuid(), f, headers);
} else {
    spprintf(&hdr, 0, "X-PHP-Originating-Script: %ld:%s\n", php_getuid(), f);
}

So, it's hard-coded to put in the uid. But let's see where that takes us.

Now, you should understand that the SAPI is basically a polymorphic way of different server APIs communicating with PHP. So if we look at a few SAPIs:

  • mod_php with Apache

    This just returns the finfo construct that apache passes it. No chance to modify it (it's not an environmental variable). It comes directly from apache. So no luck.

  • FPM

    This doesn't even implement sapi_get_stat(). So the default behavior is still run (which is a basic stat of the current path).

So the short answer is no, it's not possible without patching PHP's core...

ircmaxell
  • 163,128
  • 34
  • 264
  • 314
  • Good to point at the source, but bad to omit that the quoted code block is inside a `if (PG(mail_x_header))` condition which makes @NightOwl 's answer more plausible. – Swiss Mister Aug 13 '14 at 08:00
  • Night Owñ's solution is working so although your answer got selected by the OP what you say here is not accurate. – Dominique Feb 25 '19 at 10:39
0

This might not be the most elegant solution but it is the one that works for sure.

You can hook PHP mail function by setting wrapper script in php.ini instead of sendmail:

sendmail_path = /usr/local/bin/php_mail_wrapper

Then in the script iself you can do something like this:

#!/usr/bin/php
<?php

$sendmail_path = '/usr/sbin/sendmail';
$handle = fopen('php://stdin', 'r');
$mail = '';

while ($mail_line = fgets($handle)) {
    if (preg_match('/^X-PHP-Originating-Script:/i', $mail_line)) {
        continue;
    }
    $mail .= $mail_line;
}

$cmd = 'echo ' . escapeshellarg($mail) . ' | ' . $sendmail_path . ' -t -i';
return shell_exec($cmd);

?>

Credit for the idea goes to: How to hook PHP mail function

maxxx
  • 657
  • 7
  • 5