PEAR is discontinued

This is a static archive preserving historical releases and metadata. No new packages or updates will be published. For updates to existing packages, or to publish new packages, please use Composer and Packagist.

Home » Networking » Net_POP3 » Bug #2663

Return value of _cmdApop not properly checked on _cmdAuthenticate

Details

Submitted2004-11-01 17:08 UTC
Frombogart at ee dot upatras dot gr
Assigneddamian
StatusClosed
PackageNet_POP3
PHP Version4.3.9
OSsolaris
Roadmaps(Not assigned)

Comments

[2004-11-01 17:08 UTC] bogart at ee dot upatras dot gr

Description:
------------
Net_PHP version 1.3.3 installed from pear.php.net, patched for bug #2523

On _cmdAuthenticate, the return value of _cmdApop is compared to "false". In case the server does not support APOP, it will not fallback to _authUSER as expected (the if statement is never taken).

Reproduce code:
---------------
require_once 'Net/POP3.php';
$pop3 =& new Net_POP3();
$pop3->setDebug(true);
$ret = $pop3->connect('mymailserver', 110);
$ret = $pop3->login('validlogin', 'validpass', false);
if ( !PEAR::isError($ret) ) {
echo "Success\n";
} else {
echo "Failure\n";
}

Tried on a non-public (sorry!) qmail server, which does not support APOP.

Expected result:
----------------
S:+OK POP3 mymailserver server ready
C: CAPA
S:-ERR Unknown AUTHORIZATION state command
C: USER validlogin
S:+OK User name accepted, password please
C: PASS validpass
S:+OK Mailbox open, 1 messages
Success

A solution (may be wrong at all, but worked for me):
change at about line 407
if($result===false){
to:
if ( PEAR::isError( $result ) ) {

Another solution (using an undocumented feature: the third parameter of login is assumed to be boolean but in the code is used as string):
In the reproduce code,
change:
$ret = $pop3->login('validlogin', 'validpass', false);
to:
$ret = $pop3->login('validlogin', 'validpass', "USER");

Actual result:
--------------
Failure

[2005-02-22 07:14 UTC] hiroaki dot kawai at gmail dot com

damianm, I have a question about the updated document. Where can I get the documentation? With the current release 1.3.5 doesn't work for me.

_getBestAuthMethod($user , $pass , False) returns False, not "USER" at the line 351. Should I set the 3rd param of login() 'USER' string? This will break backward compatibility.

[2005-02-22 07:17 UTC] hiroaki dot kawai at gmail dot com

I could not figure out how to reopen this ticket, so forgive me to duplicate this bug ...