From 290f9067d090fceadd3ac17ade4f205bbf50b5fb Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Mon, 23 Feb 2009 07:48:05 +0000
Subject: [PATCH] MDL-18348 CVE-2007-3215

---
 lib/phpmailer/class.phpmailer.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/phpmailer/class.phpmailer.php b/lib/phpmailer/class.phpmailer.php
index f73a09a61ff..a00eb5ba72e 100644
--- a/lib/phpmailer/class.phpmailer.php
+++ b/lib/phpmailer/class.phpmailer.php
@@ -404,9 +404,9 @@ class PHPMailer
      */
     function SendmailSend($header, $body) {
         if ($this->Sender != "")
-            $sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender);
+            $sendmail = sprintf("%s -oi -f %s -t", escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
         else
-            $sendmail = sprintf("%s -oi -t", $this->Sendmail);
+            $sendmail = sprintf("%s -oi -t", escapeshellcmd($this->Sendmail));
 
         if(!@$mail = popen($sendmail, "w"))
         {