SYSTEM WARNING: escapeshellcmd()
Posted: 30 Dec 2007, 13:31
Hi,
just installed a new Mantis 1.1.0 and after some testing around, posting changes (Using eg. 'Add Note' or 'Update Information') to a previously added issue, i get this error on top of the page:
How can I get rid of this message? Is there a global switch to disable this?
Sometimes(if not always) I also get this message when updating an issue:
I don't have any idea what is causing this or what PHP script is showing this error. Perhaps sbdy can give me a hint?
Edit:
It seems this line in email_api.php is causing both errors:
After changing this to:
Is this line or the function call to escapeshellcmd necessary at all? Why isn't this function call made with those other email addresses from config_inc.php, too?
Thanks,
Michael
just installed a new Mantis 1.1.0 and after some testing around, posting changes (Using eg. 'Add Note' or 'Update Information') to a previously added issue, i get this error on top of the page:
Code: Select all
SYSTEM WARNING: escapeshellcmd() has been disabled for security reasons
Sometimes(if not always) I also get this message when updating an issue:
Ok, I've commented out some lines in /core/html_api.php function html_footer, however after reactivating those lines I still get this error.APPLICATION ERROR #18
Page redirection error, ensure that there are no spaces outside the PHP block (<?php ?>) in config_inc.php or custom_*.php files.
Please use the "Back" button in your web browser to return to the previous page. There you can correct whatever problems were identified in this error or select another action. You can also click an option from the menu bar to go directly to a new section.
I don't have any idea what is causing this or what PHP script is showing this error. Perhaps sbdy can give me a hint?
Edit:
It seems this line in email_api.php is causing both errors:
Code: Select all
$mail->Sender = escapeshellcmd( config_get( 'return_path_email' ) );
All runs well afterwards.$mail->Sender = config_get( 'return_path_email' );
Is this line or the function call to escapeshellcmd necessary at all? Why isn't this function call made with those other email addresses from config_inc.php, too?
Thanks,
Michael