SYSTEM WARNING: escapeshellcmd()

[Roaster]

Hi,

just installed a new Mantis 1.1.0 and after some testing around, posting changes (Using eg. 'Add Note' or 'Update Information') to a previously added issue, i get this error on top of the page:

Code: Select all

SYSTEM WARNING: escapeshellcmd() has been disabled for security reasons

How can I get rid of this message? Is there a global switch to disable this?

Sometimes(if not always) I also get this message when updating an issue:

APPLICATION ERROR #18

Page redirection error, ensure that there are no spaces outside the PHP block (<?php ?>) in config_inc.php or custom_*.php files.

Please use the "Back" button in your web browser to return to the previous page. There you can correct whatever problems were identified in this error or select another action. You can also click an option from the menu bar to go directly to a new section.

Ok, I've commented out some lines in /core/html_api.php function html_footer, however after reactivating those lines I still get this error.

I don't have any idea what is causing this or what PHP script is showing this error. Perhaps sbdy can give me a hint?

Edit:
It seems this line in email_api.php is causing both errors:

Code: Select all

		$mail->Sender   = escapeshellcmd( config_get( 'return_path_email' ) );

After changing this to:

$mail->Sender = config_get( 'return_path_email' );

All runs well afterwards.
Is this line or the function call to escapeshellcmd necessary at all? Why isn't this function call made with those other email addresses from config_inc.php, too?

Thanks,
Michael

[GeoffM]

Thanks, Michael - I got the same faults, and your solution worked for me also. It's a shame the developers haven't replied to your posting for nearly 2 months now.

Geoff M.

[vboctor]

I've just noticed this thread. It is interesting that on your systems they have disabled this command. Is this a shared hosting environment? I would like to know more about why this command is disabled.

What you are highlighting here is really a bug, where we are not handling your type of environment. Hence, I think it is best to report a bug for it in the bug tracker. In parallel to that you can create a forum thread. Developers typically concentrate more on the code and the bug tracker.