5.3.0 - Security patch

Fixed

• Potential RCE through path traversal fixed Webklex/php-imap#414 (special thanks @angelej)

Security Impact and Mitigation

Impacted are all versions below v5.3.0.
If possible, update to >= v5.3.0 as soon as possible. Impacted was the Attachment::save
method which could be used to write files to the local filesystem. The path was not
properly sanitized and could be used to write files to arbitrary locations.

However, the Attachment::save method is not used by default and has to be called
manually. If you are using this method without providing a sanitized path, you are
affected by this vulnerability.
If you are not using this method or are providing a sanitized path, you are not affected
by this vulnerability and no immediate action is required.

If you have any questions, please feel welcome to join this issue: Webklex/php-imap#416

Timeline

• 17.06.23 21:30: Vulnerability reported
• 18.06.23 19:14: Vulnerability confirmed
• 19.06.23 18:41: Vulnerability fixed via PR Webklex/php-imap#414
• 20.06.23 13:45: Security patch released

5.2.0

Fixed

• The message uid and message number will only be fetched if accessed and wasn't previously set (thanks @szymekjanaczek)
• Fix undefined attachment name when headers use "filename*=" format (thanks @JulienChavee)
• Fixed ImapProtocol::logout always throws 'not connected' Exception after upgraded to 4.1.2
• Protocol interface and methods unified
• Strict attribute and return types introduced where ever possible
• Parallel messages during idle
• Idle timeout / stale resource stream issue fixed
• Syntax updated to support php 8 features
• Get the attachment file extension from the filename if no mimetype detection library is available
• Prevent the structure parsing from parsing an empty part
• Convert all header keys to their lower case representation
• Restructure the decode function (thanks @istid)
• More unique ID generation to prevent multiple attachments with same ID (thanks @Guite)
• Not all attachments are pushed to the collection (thanks @AdrianKuriata)
• Allow search response to be empty
• Unsafe usage of switch case. (thanks @shuergab)
• Fix use of ST_MSGN as sequence method (thanks @gioid)
• Prevent infinite loop in ImapProtocol (thanks @thin-k-design)
• IMAP Quota root command fixed
• Prevent line-breaks in folder path caused by special chars
• Partial fix for (allow overview response to be empty)
• Message::setConfig() config parameter type set to array
• Reset the protocol uid cache if the session gets expunged
• Set the "seen" flag only if the flag isn't set and the fetch option isn't IMAP::FT_PEEK
• Message::is() date comparison fixed
• Message::$client could not be set to null
• in_reply_to and references parsing fixed
• Prevent message body parser from injecting empty lines
• Don't parse regular inline message parts without name or filename as attachment
• Message::hasTextBody() and Message::hasHtmlBody() should return false if the body is empty
• Imap-Protocol "empty response" detection extended to catch an empty response caused by a broken resource stream
• iconv_mime_decode() is now used with ICONV_MIME_DECODE_CONTINUE_ON_ERROR to prevent the decoding from failing
• Date decoding rules extended to support more date formats
• Unset the currently active folder if it gets deleted (prevent infinite loop)
• Attachment name and filename parsing fixed and improved to support more formats
• Check if the next uid is available (after copying or moving a message) before fetching it
• Default pagination $total attribute value set to 0 (thanks @hhniao)
• Use attachment ID as fallback filename for saving an attachment
• Address decoding error detection added
• Use all available methods to detect the attachment extension instead of just one
• Allow the LIST command response to be empty
• Initialize folder children attributes on class initialization

Added

• Unit tests added (thanks @sergiy-petrov, @boekkooi-lengoo)
• Client::clone() method added to clone a client instance
• Save an entire message (including its headers) Message::save()
• Restore a message from a local or remote file Message::fromFile()
• Protocol resource stream accessor added Protocol::getStream()
• Protocol resource stream meta data accessor added Protocol::meta()
• ImapProtocol resource stream reset method added ImapProtocol::reset()
• Protocol Response::class introduced to handle and unify all protocol requests
• Static mask config accessor added ClientManager::getMask() added
• An Attribute::class instance can be treated as array
• Get the current client account configuration via Client::getConfig()
• Delete a folder via Client::deleteFolder()
• Extended UTF-7 support added (RFC2060)
• Protocol::sizes() support added (fetch the message byte size via RFC822.SIZE). Accessible through Message::getSize() (thanks @didi1357)
• Message::hasFlag() method added to check if a message has a specific flag
• Message::getConfig() method added to get the current message configuration
• Folder::select() method added to select a folder
• Message::getAvailableFlags() method added to get all available flags
• Live mailbox and fixture tests added
• Attribute::map() method added to map all attribute values
• Header::has() method added to check if a header attribute / value exist
• All part attributes are now accessible via linked attribute
• Restore a message from string Message::fromString()
• Soft fail option added to all folder fetching methods. If soft fail is enabled, the method will return an empty collection instead of throwing an exception if the folder doesn't exist

Breaking changes

• PHP ^8.0.2 required
• nesbot/carbon version bumped to ^2.62.1
• phpunit/phpunit version bumped to ^9.5.10
• Header::get() always returns an Attribute::class instance
• Attribute::class accessor methods renamed to shorten their names and improve the readability
• All protocol methods that used to return array|bool will now always return a Response::class instance.
• ResponseException::class gets thrown if a response is empty or contains errors
• Message client is optional and can be null (e.g. if used in combination with Message::fromFile())
• The message text or html body is now "" if its empty and not null

4.1.2

Fixed

• Type casting added to several ImapProtocol return values
• Remove IMAP::OP_READONLY flag from imap_reopen if POP3 or NNTP protocol is selected (thanks @xianzhe18)
• Several statements optimized and redundant checks removed
• Check if the Protocol supports the fetch method if extensions are present
• Detect NONEXISTENT errors while selecting or examining a folder
• Missing type cast added to PaginatedCollection::paginate (thanks @rogerb87)
• Fix multiline header unfolding (thanks @sulgie-eitea)
• Fix problem with illegal offset error (thanks @szymekjanaczek)
• Typos fixed
• RFC 822 3.1.1. long header fields regular expression fixed (thanks @hbraehne)
• Fix assumedNextTaggedLine bug (thanks @Blear)
• Fix empty response error for blank lines (thanks @bierpub)
• Fix empty body (thanks @latypoff)
• Fix imap_reopen folder argument (thanks @latypoff)
• Fix for extension recognition (thanks @pwoszczyk)
• Missing null check added (thanks @spanjeta)
• Leading white-space in response causes an infinite loop (thanks @thin-k-design)
• Fix error when creating folders with special chars (thanks @thin-k-design)
• Client::getFoldersWithStatus() recursive loading fixed (thanks @szymekjanaczek)
• Fix Folder name encoding error in Folder::appendMessage() (thanks @rskrzypczak)
• Attachment ID can return an empty value
• Additional message date format added (thanks @amorebietakoUdala)

Added

• Added possibility of loading a Folder status (thanks @szymekjanaczek)

4.0.0

Fixed

• PHP dependency updated to support php v8.0 (thanks @freescout-helpdesk)
• Method return and argument types added
• Imap DONE method refactored
• UID cache loop fixed
• HasEvent::getEvent return value set to mixed to allow multiple event types
• Protocol line reader changed to fread (stream_context timeout issue fixed)
• Issue setting the client timeout fixed
• IMAP Connection debugging improved
• Folder::idle() method reworked and several issues fixed
• Datetime conversion rules extended

Breaking changes

• No longer supports php >=5.5.9 but instead requires at least php v7.0.0.
• HasEvent::getEvent returns a mixed result. Either an Event or a class string representing the event class.
• The error message, if the connection fails to read the next line, is now empty response instead of failed to read - connection closed?.
• The $auto_reconnect used with Folder::indle() is deprecated and doesn't serve any purpose anymore.

3.0.0-alpha

Fixed

• Debug line position fixed
• Handle incomplete address to string conversion
• Configured message key gets overwritten by the first fetched message
• Attachment::save() return error 'A facade root has not been set'
• Unused dependencies removed
• Fix PHP 8 error that changes null back in to an empty string. (thanks @mennovanhout)
• Fix regex to be case insensitive (thanks @mennovanhout)
• Attachment detection updated
• Timeout handling improved
• Additional utf-8 checks added to prevent decoding of unencoded values
• Boundary detection simplified
• Prevent potential body overwriting
• CSV files are no longer regarded as plain body
• Boundary detection overhauled to support "related" and "alternative" multipart messages
• Attachment saving filename fixed
• Unnecessary parameter removed from Client::getTimeout()
• Missing encryption variable added - could have caused problems with unencrypted communications
• Prefer attachment filename attribute over name attribute
• Missing connection settings added to Folder:idle() auto mode
• Message move / copy expect a folder path
• Client::getFolder() updated to circumvent special edge cases
• Missing connection status checks added to various methods
• Unused default attribute message_no removed from Message::class
• Fix setting default mask from config (thanks @shacky)
• Chunked fetch fails in case of less available mails than page size
• Protocol::createStream() exception information fixed
• Legacy methods (headers, content, flags) fixed
• Legacy connection cycle fixed (thanks @zssarkany)
• Several POP3 fixes (thanks @Korko)
• Fixes handling of long header lines which are seperated by \r\n\t (thanks @Oliver-Holz)
• Fixes to line parsing with multiple addresses (thanks @Oliver-Holz)
• Fixed problem with skipping last line of the response. (thanks @szymekjanaczek)
• Extend date parsing error message
• Fixed 'Where' method replaces the content with uppercase
• Don't surround numeric search values with quotes
• Context added to InvalidWhereQueryCriteriaException
• Redundant stream_set_timeout() removed

Added

• Auto reconnect option added to Folder::idle()
• Dynamic Attribute access support added (e.g $message->from[0])
• Message not found exception added
• Chunked fetching support added Query::chunked(). Just in case you can't fetch all messages at once
• "Soft fail" support added
• Count method added to Attribute:class
• Convert an Attribute instance into a Carbon date object
• Disable rfc822 header parsing via config option
• Added imap 4 handling. (thanks @szymekjanaczek)
• Added laravel's conditionable methods. (thanks @szymekjanaczek)
• Expose message folder path (thanks @Magiczne)
• Adds mailparse_rfc822_parse_addresses integration (thanks @Oliver-Holz)
• Added moveManyMessages method (thanks @Magiczne)
• Added copyManyMessages method (thanks @Magiczne)
• Added UID as available search criteria (thanks @szymekjanaczek)
• Make boundary regex configurable (thanks @EthraZa)
• IMAP ID support added
• Enable debug mode via config
• Custom UID alternative support added
• Fetch additional extensions using Folder::query(["FEATURE_NAME"])
• Optionally move a message during "deletion" instead of just "flagging" it (thanks @EthraZa)
• WhereQuery::where() accepts now a wide range of criteria / values.

Breaking changes

• A new exception can occur if a message can't be fetched (\Webklex\PHPIMAP\Exceptions\MessageNotFoundException::class)
• Message::move() and Message::copy() no longer accept folder names as folder path
• A Message::class instance might no longer have a message_no attribute
• All protocol methods which had a boolean $uid option no longer support a boolean. Use IMAP::ST_UID or IMAP::NIL instead. If you want to use an alternative to UID just use the string instead.
• Default config option options.sequence changed from IMAP::ST_MSGN to IMAP::ST_UID.
• Folder::query() no longer accepts a charset string. It has been replaced by an extension array, which provides the ability to automatically fetch additional features.

2.4.0

Fixed

• Attachment::save() return error 'A facade root has not been set'
• Unused dependencies removed
• Fix PHP 8 error that changes null back in to an empty string. (thanks @mennovanhout)
• Fix regex to be case insensitive (thanks @mennovanhout)
• Debug line position fixed
• Handle incomplete address to string conversion
• Configured message key gets overwritten by the first fetched message
• Get partial overview when IMAP::ST_UID is set
• Unnecessary "'" removed from address names
• Folder referral typo fixed
• Legacy protocol fixed
• Treat message collection keys always as strings
• Missing RFC attributes added
• Set the message sequence when idling
• Missing UID commands added

Added

• Configurable supported default flags added
• Message attribute class added to unify value handling
• Address class added and integrated
• Alias Message::attachments() for Message::getAttachments() added
• Alias Message::addFlag() for Message::setFlag() added
• Alias Message::removeFlag() for Message::unsetFlag() added
• Alias Message::flags() for Message::getFlags() added
• New Exception MessageFlagException::class added
• New method Message::setSequenceId($id) added
• Optional Header attributizion option added
• Get a message by its message number
• Get a message by its uid

Breaking changes

• Stringified message headers are now separated by ", " instead of " ".
• All message header values such as subject, message_id, from, to, etc now consists of an Àttribute::class instance (should behave the same way as before, but might cause some problem in certain edge cases)
• The formal address object "from", "to", etc now consists of an Address::class instance (should behave the same way as before, but might cause some problem in certain edge cases)
• When fetching or manipulating message flags a MessageFlagException::class exception can be thrown if a runtime error occurs
• Learn more about the new Attribute class here: www.php-imap.com/api/attribute
• Learn more about the new Address class here: www.php-imap.com/api/address
• Folder attribute "referal" is now called "referral"

2.3.0

Fixed

• Missing env variable IMAP_AUTHENTICATION added
• Header decoding problem fixed
• IMAP::FT_PEEK removing "Seen" flag issue fixed
• Text/Html body fetched as attachment if subtype is null
• Potential header overwriting through header extensions
• Prevent empty attachments
• Search performance increased by fetching all headers, bodies and flags at once
• Legacy protocol support updated
• Fix Query pagination. (thanks @mikemiller891)
• Missing array decoder method added (thanks @lutchin)
• Additional checks added to prevent message from getting marked as seen
• Boundary parsing improved (thanks @AntonioDiPassio-AppSys)
• Idle operation updated
• Cert validation issue fixed
• Allow boundaries ending with a space or semicolon (thanks @smartilabs)
• Ignore IMAP DONE command response
• Default options.fetch set to IMAP::FT_PEEK
• Address parsing fixed
• Alternative rfc822 header parsing fixed
• Parse more than one header key
• Fetch folder overview fixed
• Message::getTextBody() fallback value fixed

Added

• Default folder locations added
• Search for messages by message-Id
• Search for messages by In-Reply-To
• Message threading added Message::thread()
• Default folder locations added
• Set fetch order during query @Max13
• Missing message setter methods added
• Folder::overview() method added to fetch all headers of all messages in the current folder
• Force a folder to be opened
• Proxy support added
• Flexible disposition support added
• New options.message_key option uid added
• Protocol UID support added
• Flexible sequence type support added

Breaking changes

• Depending on your configuration, your certificates actually get checked. Which can cause an aborted connection if the certificate can not be validated.
• Messages don't get flagged as read unless you are using your own custom config.
• All Header::class attribute keys are now in a snake_format and no longer minus-separated.
• Message::getTextBody() no longer returns false if no text body is present. null is returned instead.

2.2.0

Fixed

• Prevent text bodies from being fetched as attachment
• Missing variable check added to prevent exception while parsing an address #356
• Missing variable check added to prevent exception while parsing a part subtype
• Missing variable check added to prevent exception while parsing a part content-type #356
• Mixed message header attribute in_reply_to "unified" to be always an array
• Potential message moving / copying problem fixed
• Move messages by using Protocol::moveMessage() instead of Protocol::copyMessage() and Message::delete()
• Boundary detection problem fixed (@DasTobbel)
• Content-Type detection problem fixed (@DasTobbel)
• If content disposition is multiline, implode the array to a simple string (@DasTobbel)
• Potential problematic prefixed white-spaces removed from header attributes
• Fix inline attachments and embedded images (@dwalczyk)
• Possible error during address decoding fixed (@Slauta)
• Flag event dispatching fixed
• Fixed Query::paginate() (@Max13)
• Message::getAttributes() hasn't returned all parameters
• Wrong message content property reference fixed
• Fix header extension values
• Part header detection method changed
• Possible decoding problem fixed
• Str::class dependency removed from Header::class
• Dependency problem in Attachement::getExtension() fixed
• Quota handling fixed

Added

• Protocol::moveMessage() method added
• Expended Client::getFolder($name, $deleimiter = null) to accept either a folder name or path (@DasTobbel)
• Special MS-Exchange header decoding support added
• ClientManager::make() method added to support undefined accounts
• Alternative attachment names support added (@oneFoldSoftware)
• Fetch message content without leaving a "Seen" flag behind
• Support multiple boundaries (@dwalczyk)
• Part number added to attachment
• Client::getFolderByPath() added (@Max13)
• Client::getFolderByName() added (@Max13)
• Throws exceptions if the authentication fails (@Max13)
• Default account config fallback added

Breaking changes

• Text bodies might no longer get fetched as attachment
• Message::$in_reply_to type changed from mixed to array

2.1.1

Fixed

• Missing default config parameter added #346

Added

• Imap idle command added

2.1.0

Fixed

• Redundant class ClientManager::class removed and config handling moved to depending library "webklex/php-imap" #345 #344

Breaking changes

• \Webklex\IMAP\ClientManager::class no longer exists. Please use the \Webklex\IMAP\Facades\Client::class facade or \Webklex\PHPIMAP\ClientManager::class instead.