Possible Bug in smtp.php - SMTP HELO

Phrak79

Joined: 2009-05-15
Posts: 8
Posted: Mon, 2009-05-18 06:32

Hello,
I believe I have encountered an issue with the SMTP HELO and EHLO functions in /lib/smtp/smtp.php

The default behaviour of this script is to echo HELO to the defined SMTP server AS the SMTP server, quite often resulting in the connection being rejected because the server believes it's about to be spoofed.

The code in question is lines 82 & 106 in smtp.php, with the following command (ln 106):
//fputs($socket, "HELO" . $config['smtp.host'] . "\r\n");

The correct usage of an SMTP HELO should be to say HELO as the sending domain.

A workaround to the issue is to manually define the connection string as the sending domain, such as:
//fputs($socket, "HELO gmail.com" . "\r\n");

The complete fix would be to split domain from the SMTP FROM address ($config['smtp.from']) at the '@' symbol and use this domain in the HELO and EHLO connection string.

If my php coding skillz were up to scratch, I would give an example... Unfortunately they're not, but the php split function looks like it would do the trick.

Happy to consider any comments.

Tim