Home » Networking » Net_IMAP » Bug #7588

[2006-05-09 06:26 UTC] jamesr at totalinfosecurity dot com

Description:
------------
The method mailboxExist() should only return true if a mailbox with exactly the same name already exists. This is critical, since this test is used by Net_Cyrus->userExist(). Unfortunately, mailboxExist() will return true even when the mailbox doesn't exist. This happens in the case when the mailbox name you are testing exists as a substring of an existing mailbox. For example, if a mailbox named "user.james12" already exists, and you want to test if a mailbox name to "user.james" exists, mailboxExist("user.james") returns true. This behavior is not correct. It should return false, since a mailbox named "user.james" does not exist.

Test script:
---------------
The problem with the method is that it calls another method getMailboxes(), and it expects this method to return non-false only when there is an exact match. However, this is not how to getMailboxes() is designed to work. getMailboxes() returns an array of all mailboxes that contain the search pattern.

In order to fix this bug, I have altered the method mailboxExist() as shown below. I take the return value from getMailboxes() and look for an exact match with the search pattern.

Actual result:
--------------
This is my version of mailboxExist. I have tested it and it behaves properly.

function mailboxExist($mailbox)
{
// true means do an exact match
if( PEAR::isError( $ret = $this->getMailboxes( $mailbox , true ) ) ){
return $ret;
}
if( count( $ret ) > 0 ){
foreach ($ret as $mailbox_name) {
if ($mailbox_name == $mailbox) {
return true;
}
}
}
return false;
}

[2006-05-18 23:12 UTC] amistry at php dot net

I've fixed this in the CVS.