The transport DSN can be used to execute arbitrary system/shell code by means of the sendmail transport with a custom command. DsnTransport guards against this, however there is a risk that some other code accepts a string from an untrusted source. Even a full admin GUI user should not be allowed to run arbitrary system code.
This module should check the DSN string in Mailer::doSend(), just before calling Dsn::fromString. If the protocol is sendmail and the command parameter is set, then it must be one of Settings::get('mailer_sendmail_commands').
Fixed
1.0
Code
Automatically closed - issue fixed for 2 weeks with no activity.