PHPMailer upgrade to v6.2.0

2025-01-16 20:28:28 +01:00 · 2021-06-25 11:45:58 -07:00 · 2021-06-25 11:45:58 -07:00 · 3430342d0d
commit 3430342d0d
parent fd06147900
16 changed files with 150 additions and 68 deletions
--- a/composer.lock
+++ b/composer.lock
@ -8,16 +8,16 @@
    "packages": [
        {
            "name": "guzzlehttp/psr7",
-            "version": "1.8.1",
+            "version": "1.8.2",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/psr7.git",
-                "reference": "35ea11d335fd638b5882ff1725228b3d35496ab1"
+                "reference": "dc960a912984efb74d0a90222870c72c87f10c91"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/psr7/zipball/35ea11d335fd638b5882ff1725228b3d35496ab1",
-                "reference": "35ea11d335fd638b5882ff1725228b3d35496ab1",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/dc960a912984efb74d0a90222870c72c87f10c91",
+                "reference": "dc960a912984efb74d0a90222870c72c87f10c91",
                "shasum": ""
            },
            "require": {
@ -77,9 +77,9 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/psr7/issues",
-                "source": "https://github.com/guzzle/psr7/tree/1.8.1"
+                "source": "https://github.com/guzzle/psr7/tree/1.8.2"
            },
-            "time": "2021-03-21T16:25:00+00:00"
+            "time": "2021-04-26T09:17:50+00:00"
        },
        {
            "name": "hybridauth/hybridauth",
--- a/e107_handlers/vendor/composer/InstalledVersions.php
+++ b/e107_handlers/vendor/composer/InstalledVersions.php
@ -29,7 +29,7 @@ private static $installed = array (
    'aliases' => 
    array (
    ),
-    'reference' => '2862e18db94899361a4d5be20c3e2d990b79e67a',
+    'reference' => '7beae22f44f50501bd888f180c425dc75915c8af',
    'name' => 'e107inc/e107',
  ),
  'versions' => 
@ -41,16 +41,16 @@ private static $installed = array (
      'aliases' => 
      array (
      ),
-      'reference' => '2862e18db94899361a4d5be20c3e2d990b79e67a',
+      'reference' => '7beae22f44f50501bd888f180c425dc75915c8af',
    ),
    'guzzlehttp/psr7' => 
    array (
-      'pretty_version' => '1.8.1',
-      'version' => '1.8.1.0',
+      'pretty_version' => '1.8.2',
+      'version' => '1.8.2.0',
      'aliases' => 
      array (
      ),
-      'reference' => '35ea11d335fd638b5882ff1725228b3d35496ab1',
+      'reference' => 'dc960a912984efb74d0a90222870c72c87f10c91',
    ),
    'hybridauth/hybridauth' => 
    array (
@ -99,12 +99,12 @@ private static $installed = array (
    ),
    'phpmailer/phpmailer' => 
    array (
-      'pretty_version' => 'v6.4.0',
-      'version' => '6.4.0.0',
+      'pretty_version' => 'v6.5.0',
+      'version' => '6.5.0.0',
      'aliases' => 
      array (
      ),
-      'reference' => '050d430203105c27c30efd1dce7aa421ad882d01',
+      'reference' => 'a5b5c43e50b7fba655f793ad27303cd74c57363c',
    ),
    'psr/http-message' => 
    array (
--- a/e107_handlers/vendor/composer/installed.json
+++ b/e107_handlers/vendor/composer/installed.json
@ -2,17 +2,17 @@
    "packages": [
        {
            "name": "guzzlehttp/psr7",
-            "version": "1.8.1",
-            "version_normalized": "1.8.1.0",
+            "version": "1.8.2",
+            "version_normalized": "1.8.2.0",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/psr7.git",
-                "reference": "35ea11d335fd638b5882ff1725228b3d35496ab1"
+                "reference": "dc960a912984efb74d0a90222870c72c87f10c91"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/psr7/zipball/35ea11d335fd638b5882ff1725228b3d35496ab1",
-                "reference": "35ea11d335fd638b5882ff1725228b3d35496ab1",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/dc960a912984efb74d0a90222870c72c87f10c91",
+                "reference": "dc960a912984efb74d0a90222870c72c87f10c91",
                "shasum": ""
            },
            "require": {
@ -30,7 +30,7 @@
            "suggest": {
                "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses"
            },
-            "time": "2021-03-21T16:25:00+00:00",
+            "time": "2021-04-26T09:17:50+00:00",
            "type": "library",
            "extra": {
                "branch-alias": {
@ -74,7 +74,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/psr7/issues",
-                "source": "https://github.com/guzzle/psr7/tree/1.8.1"
+                "source": "https://github.com/guzzle/psr7/tree/1.8.2"
            },
            "install-path": "../guzzlehttp/psr7"
        },
@ -417,17 +417,17 @@
        },
        {
            "name": "phpmailer/phpmailer",
-            "version": "v6.4.0",
-            "version_normalized": "6.4.0.0",
+            "version": "v6.5.0",
+            "version_normalized": "6.5.0.0",
            "source": {
                "type": "git",
                "url": "https://github.com/PHPMailer/PHPMailer.git",
-                "reference": "050d430203105c27c30efd1dce7aa421ad882d01"
+                "reference": "a5b5c43e50b7fba655f793ad27303cd74c57363c"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/050d430203105c27c30efd1dce7aa421ad882d01",
-                "reference": "050d430203105c27c30efd1dce7aa421ad882d01",
+                "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/a5b5c43e50b7fba655f793ad27303cd74c57363c",
+                "reference": "a5b5c43e50b7fba655f793ad27303cd74c57363c",
                "shasum": ""
            },
            "require": {
@ -452,7 +452,7 @@
                "stevenmaguire/oauth2-microsoft": "Needed for Microsoft XOAUTH2 authentication",
                "symfony/polyfill-mbstring": "To support UTF-8 if the Mbstring PHP extension is not enabled (^1.2)"
            },
-            "time": "2021-03-31T20:06:42+00:00",
+            "time": "2021-06-16T14:33:43+00:00",
            "type": "library",
            "installation-source": "dist",
            "autoload": {
@ -484,7 +484,7 @@
            "description": "PHPMailer is a full-featured email creation and transfer class for PHP",
            "support": {
                "issues": "https://github.com/PHPMailer/PHPMailer/issues",
-                "source": "https://github.com/PHPMailer/PHPMailer/tree/v6.4.0"
+                "source": "https://github.com/PHPMailer/PHPMailer/tree/v6.5.0"
            },
            "funding": [
                {
--- a/e107_handlers/vendor/composer/installed.php
+++ b/e107_handlers/vendor/composer/installed.php
@ -6,7 +6,7 @@
    'aliases' => 
    array (
    ),
-    'reference' => '2862e18db94899361a4d5be20c3e2d990b79e67a',
+    'reference' => '7beae22f44f50501bd888f180c425dc75915c8af',
    'name' => 'e107inc/e107',
  ),
  'versions' => 
@ -18,16 +18,16 @@
      'aliases' => 
      array (
      ),
-      'reference' => '2862e18db94899361a4d5be20c3e2d990b79e67a',
+      'reference' => '7beae22f44f50501bd888f180c425dc75915c8af',
    ),
    'guzzlehttp/psr7' => 
    array (
-      'pretty_version' => '1.8.1',
-      'version' => '1.8.1.0',
+      'pretty_version' => '1.8.2',
+      'version' => '1.8.2.0',
      'aliases' => 
      array (
      ),
-      'reference' => '35ea11d335fd638b5882ff1725228b3d35496ab1',
+      'reference' => 'dc960a912984efb74d0a90222870c72c87f10c91',
    ),
    'hybridauth/hybridauth' => 
    array (
@ -76,12 +76,12 @@
    ),
    'phpmailer/phpmailer' => 
    array (
-      'pretty_version' => 'v6.4.0',
-      'version' => '6.4.0.0',
+      'pretty_version' => 'v6.5.0',
+      'version' => '6.5.0.0',
      'aliases' => 
      array (
      ),
-      'reference' => '050d430203105c27c30efd1dce7aa421ad882d01',
+      'reference' => 'a5b5c43e50b7fba655f793ad27303cd74c57363c',
    ),
    'psr/http-message' => 
    array (
--- a/e107_handlers/vendor/guzzlehttp/psr7/CHANGELOG.md
+++ b/e107_handlers/vendor/guzzlehttp/psr7/CHANGELOG.md
@ -7,16 +7,22 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).


-## [Unreleased]
+## Unreleased

-## [1.8.1] - 2021-03-21
+## 1.8.2 - 2021-04-26
+
+### Fixed
+
+- Handle possibly unset `url` in `stream_get_meta_data`
+
+## 1.8.1 - 2021-03-21

 ### Fixed

 - Issue parsing IPv6 URLs
 - Issue modifying ServerRequest lost all its attributes

-## [1.8.0] - 2021-03-21
+## 1.8.0 - 2021-03-21

 ### Added

@ -28,7 +34,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Issue when creating stream from `php://input` and curl-ext is not installed
 - Broken `Utils::tryFopen()` on PHP 8

-## [1.7.0] - 2020-09-30
+## 1.7.0 - 2020-09-30

 ### Added

@ -272,7 +278,6 @@ Currently unsupported:



-[Unreleased]: https://github.com/guzzle/psr7/compare/1.6.0...HEAD
 [1.6.0]: https://github.com/guzzle/psr7/compare/1.5.2...1.6.0
 [1.5.2]: https://github.com/guzzle/psr7/compare/1.5.1...1.5.2
 [1.5.1]: https://github.com/guzzle/psr7/compare/1.5.0...1.5.1
--- a/e107_handlers/vendor/guzzlehttp/psr7/src/Uri.php
+++ b/e107_handlers/vendor/guzzlehttp/psr7/src/Uri.php
@ -109,7 +109,7 @@ class Uri implements UriInterface
            $url
        );

-        $result = parse_url($prefix.$encodedUrl);
+        $result = parse_url($prefix . $encodedUrl);

        if ($result === false) {
            return false;
--- a/e107_handlers/vendor/guzzlehttp/psr7/src/Utils.php
+++ b/e107_handlers/vendor/guzzlehttp/psr7/src/Utils.php
@ -217,7 +217,7 @@ final class Utils
            ->withQueryParams($request->getQueryParams())
            ->withCookieParams($request->getCookieParams())
            ->withUploadedFiles($request->getUploadedFiles());
-        
+
            foreach ($request->getAttributes() as $key => $value) {
                $new = $new->withAttribute($key, $value);
            }
@ -317,7 +317,8 @@ final class Utils
                 * The 'php://input' is a special stream with quirks and inconsistencies.
                 * We avoid using that stream by reading it into php://temp
                 */
-                if (\stream_get_meta_data($resource)['uri'] === 'php://input') {
+                $metaData = \stream_get_meta_data($resource);
+                if (isset($metaData['uri']) && $metaData['uri'] === 'php://input') {
                    $stream = self::tryFopen('php://temp', 'w+');
                    fwrite($stream, stream_get_contents($resource));
                    fseek($stream, 0);
--- a/e107_handlers/vendor/phpmailer/phpmailer/SECURITY.md
+++ b/e107_handlers/vendor/phpmailer/phpmailer/SECURITY.md
@ -2,6 +2,13 @@

 Please disclose any security issues or vulnerabilities found through [Tidelift's coordinated disclosure system](https://tidelift.com/security) or to the maintainers privately.

+PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the `$patternselect` parameter to `validateAddress()` is set to `'php'` (the default, defined by `PHPMailer::$validator`), and the global namespace contains a function called `php`, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names. Recorded as [CVE-2021-3603](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3603). Reported by [Vikrant Singh Chauhan](mailto:vi@hackberry.xyz) via [huntr.dev](https://www.huntr.dev/).
+
+PHPMailer versions 6.4.1 and earlier contain a possible remote code execution vulnerability through the `$lang_path` parameter of the `setLanguage()` method. If the `$lang_path` parameter is passed unfiltered from user input, it can be set to [a UNC path](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#unc-paths), and if an attacker is also able to persuade the server to load a file from that UNC path, a script file under their control may be executed. This vulnerability only applies to systems that resolve UNC paths, typically only Microsoft Windows.
+PHPMailer 6.5.0 mitigates this by no longer treating translation files as PHP code, but by parsing their text content directly. This approach avoids the possibility of executing unknown code while retaining backward compatibility. This isn't ideal, so the current translation format is deprecated and will be replaced in the next major release. Recorded as [CVE-2021-34551](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34551). Reported by [Jilin Diting Information Technology Co., Ltd](https://listensec.com) via Tidelift.
+
+PHPMailer versions between 6.1.8 and 6.4.0 contain a regression of the earlier CVE-2018-19296 object injection vulnerability as a result of [a fix for Windows UNC paths in 6.1.8](https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9). Recorded as [CVE-2020-36326](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36326). Reported by Fariskhi Vidyan via Tidelift. 6.4.1 fixes this issue, and also enforces stricter checks for URL schemes in local path contexts.
+
 PHPMailer versions 6.1.5 and earlier contain an output escaping bug that occurs in `Content-Type` and `Content-Disposition` when filenames passed into `addAttachment` and other methods that accept attachment names contain double quote characters, in contravention of RFC822 3.4.1. No specific vulnerability has been found relating to this, but it could allow file attachments to bypass attachment filters that are based on matching filename extensions. Recorded as [CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625). Reported by Elar Lang of Clarified Security.

 PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing `phar://` paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. Recorded as [CVE-2018-19296](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19296). See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.
--- a/e107_handlers/vendor/phpmailer/phpmailer/VERSION
+++ b/e107_handlers/vendor/phpmailer/phpmailer/VERSION
@ -1 +1 @@
-6.4.0
+6.5.0
--- a/e107_handlers/vendor/phpmailer/phpmailer/composer.json
+++ b/e107_handlers/vendor/phpmailer/phpmailer/composer.json
@ -57,5 +57,9 @@
            "PHPMailer\\Test\\": "test/"
        }
    },
-    "license": "LGPL-2.1-only"
+    "license": "LGPL-2.1-only",
+    "scripts": {
+        "check": "./vendor/bin/phpcs",
+        "test": "./vendor/bin/phpunit"
+    }
 }
--- a/e107_handlers/vendor/phpmailer/phpmailer/language/phpmailer.lang-ar.php
+++ b/e107_handlers/vendor/phpmailer/phpmailer/language/phpmailer.lang-ar.php
@ -19,8 +19,7 @@ $PHPMAILER_LANG['instantiate']          = 'لا يمكن توفير خدمة ا
 $PHPMAILER_LANG['invalid_address']      = 'الإرسال غير ممكن لأن عنوان البريد الإلكتروني غير صالح: ';
 $PHPMAILER_LANG['mailer_not_supported'] = ' برنامج الإرسال غير مدعوم.';
 $PHPMAILER_LANG['provide_address']      = 'يجب توفير عنوان البريد الإلكتروني لمستلم واحد على الأقل.';
-$PHPMAILER_LANG['recipients_failed']    = 'خطأ SMTP: الأخطاء التالية ' .
-                                          'فشل في الارسال لكل من : ';
+$PHPMAILER_LANG['recipients_failed']    = 'خطأ SMTP: الأخطاء التالية فشل في الارسال لكل من : ';
 $PHPMAILER_LANG['signing']              = 'خطأ في التوقيع: ';
 $PHPMAILER_LANG['smtp_connect_failed']  = 'SMTP Connect() غير ممكن.';
 $PHPMAILER_LANG['smtp_error']           = 'خطأ على مستوى الخادم SMTP: ';
--- a/e107_handlers/vendor/phpmailer/phpmailer/language/phpmailer.lang-sr_latn.php
+++ b/e107_handlers/vendor/phpmailer/phpmailer/language/phpmailer.lang-sr_latn.php
@ -0,0 +1,28 @@
+<?php
+
+/**
+ * Serbian PHPMailer language file: refer to English translation for definitive list
+ * @package PHPMailer
+ * @author Александар Јевремовић <ajevremovic@gmail.com>
+ * @author Miloš Milanović <mmilanovic016@gmail.com>
+ */
+
+$PHPMAILER_LANG['authenticate']         = 'SMTP greška: autentifikacija nije uspela.';
+$PHPMAILER_LANG['connect_host']         = 'SMTP greška: povezivanje sa SMTP serverom nije uspelo.';
+$PHPMAILER_LANG['data_not_accepted']    = 'SMTP greška: podaci nisu prihvaćeni.';
+$PHPMAILER_LANG['empty_message']        = 'Sadržaj poruke je prazan.';
+$PHPMAILER_LANG['encoding']             = 'Nepoznato kodiranje: ';
+$PHPMAILER_LANG['execute']              = 'Nije moguće izvršiti naredbu: ';
+$PHPMAILER_LANG['file_access']          = 'Nije moguće pristupiti datoteci: ';
+$PHPMAILER_LANG['file_open']            = 'Nije moguće otvoriti datoteku: ';
+$PHPMAILER_LANG['from_failed']          = 'SMTP greška: slanje sa sledećih adresa nije uspelo: ';
+$PHPMAILER_LANG['recipients_failed']    = 'SMTP greška: slanje na sledeće adrese nije uspelo: ';
+$PHPMAILER_LANG['instantiate']          = 'Nije moguće pokrenuti mail funkciju.';
+$PHPMAILER_LANG['invalid_address']      = 'Poruka nije poslata. Neispravna adresa: ';
+$PHPMAILER_LANG['mailer_not_supported'] = ' majler nije podržan.';
+$PHPMAILER_LANG['provide_address']      = 'Definišite bar jednu adresu primaoca.';
+$PHPMAILER_LANG['signing']              = 'Greška prilikom prijave: ';
+$PHPMAILER_LANG['smtp_connect_failed']  = 'Povezivanje sa SMTP serverom nije uspelo.';
+$PHPMAILER_LANG['smtp_error']           = 'Greška SMTP servera: ';
+$PHPMAILER_LANG['variable_set']         = 'Nije moguće zadati niti resetovati promenljivu: ';
+$PHPMAILER_LANG['extension_missing']    = 'Nedostaje proširenje: ';
--- a/e107_handlers/vendor/phpmailer/phpmailer/language/phpmailer.lang-uk.php
+++ b/e107_handlers/vendor/phpmailer/phpmailer/language/phpmailer.lang-uk.php
@ -16,11 +16,11 @@ $PHPMAILER_LANG['file_access']          = 'Немає доступу до фай
 $PHPMAILER_LANG['file_open']            = 'Помилка файлової системи: не вдається відкрити файл: ';
 $PHPMAILER_LANG['from_failed']          = 'Невірна адреса відправника: ';
 $PHPMAILER_LANG['instantiate']          = 'Неможливо запустити функцію mail().';
-$PHPMAILER_LANG['provide_address']      = 'Будь-ласка, введіть хоча б одну email-адресу отримувача.';
+$PHPMAILER_LANG['provide_address']      = 'Будь ласка, введіть хоча б одну email-адресу отримувача.';
 $PHPMAILER_LANG['mailer_not_supported'] = ' - поштовий сервер не підтримується.';
 $PHPMAILER_LANG['recipients_failed']    = 'Помилка SMTP: не вдалося відправлення для таких отримувачів: ';
 $PHPMAILER_LANG['empty_message']        = 'Пусте повідомлення';
-$PHPMAILER_LANG['invalid_address']      = 'Не відправлено через невірний формат email-адреси: ';
+$PHPMAILER_LANG['invalid_address']      = 'Не відправлено через неправильний формат email-адреси: ';
 $PHPMAILER_LANG['signing']              = 'Помилка підпису: ';
 $PHPMAILER_LANG['smtp_connect_failed']  = 'Помилка з\'єднання з SMTP-сервером';
 $PHPMAILER_LANG['smtp_error']           = 'Помилка SMTP-сервера: ';
--- a/e107_handlers/vendor/phpmailer/phpmailer/src/PHPMailer.php
+++ b/e107_handlers/vendor/phpmailer/phpmailer/src/PHPMailer.php
@ -428,9 +428,11 @@ class PHPMailer
    public $Debugoutput = 'echo';

    /**
-     * Whether to keep SMTP connection open after each message.
-     * If this is set to true then to close the connection
-     * requires an explicit call to smtpClose().
+     * Whether to keep the SMTP connection open after each message.
+     * If this is set to true then the connection will remain open after a send,
+     * and closing the connection will require an explicit call to smtpClose().
+     * It's a good idea to use this if you are sending multiple messages as it reduces overhead.
+     * See the mailing list example for how to use it.
     *
     * @var bool
     */
@ -748,7 +750,7 @@ class PHPMailer
     *
     * @var string
     */
-    const VERSION = '6.4.0';
+    const VERSION = '6.5.0';

    /**
     * Error severity: message only, continue processing.
@ -1335,7 +1337,8 @@ class PHPMailer
        if (null === $patternselect) {
            $patternselect = static::$validator;
        }
-        if (is_callable($patternselect)) {
+        //Don't allow strings as callables, see SECURITY.md and CVE-2021-3603
+        if (is_callable($patternselect) && !is_string($patternselect)) {
            return call_user_func($patternselect, $address);
        }
        //Reject line breaks in addresses; it's valid RFC5322, but not RFC5321
@ -1721,9 +1724,10 @@ class PHPMailer
                fwrite($mail, $header);
                fwrite($mail, $body);
                $result = pclose($mail);
+                $addrinfo = static::parseAddresses($toAddr);
                $this->doCallback(
                    ($result === 0),
-                    [$toAddr],
+                    [[$addrinfo['address'], $addrinfo['name']]],
                    $this->cc,
                    $this->bcc,
                    $this->Subject,
@ -1810,7 +1814,8 @@ class PHPMailer
     */
    protected static function isPermittedPath($path)
    {
-        return !preg_match('#^[a-z]+://#i', $path);
+        //Matches scheme definition from https://tools.ietf.org/html/rfc3986#section-3.1
+        return !preg_match('#^[a-z][a-z\d+.-]*://#i', $path);
    }

    /**
@ -1822,12 +1827,15 @@ class PHPMailer
     */
    protected static function fileIsAccessible($path)
    {
+        if (!static::isPermittedPath($path)) {
+            return false;
+        }
        $readable = file_exists($path);
        //If not a UNC path (expected to start with \\), check read permission, see #2069
        if (strpos($path, '\\\\') !== 0) {
            $readable = $readable && is_readable($path);
        }
-        return static::isPermittedPath($path) && $readable;
+        return  $readable;
    }

    /**
@ -1876,7 +1884,17 @@ class PHPMailer
        if ($this->SingleTo && count($toArr) > 1) {
            foreach ($toArr as $toAddr) {
                $result = $this->mailPassthru($toAddr, $this->Subject, $body, $header, $params);
-                $this->doCallback($result, [$toAddr], $this->cc, $this->bcc, $this->Subject, $body, $this->From, []);
+                $addrinfo = static::parseAddresses($toAddr);
+                $this->doCallback(
+                    $result,
+                    [[$addrinfo['address'], $addrinfo['name']]],
+                    $this->cc,
+                    $this->bcc,
+                    $this->Subject,
+                    $body,
+                    $this->From,
+                    []
+                );
            }
        } else {
            $result = $this->mailPassthru($to, $this->Subject, $body, $header, $params);
@ -1965,7 +1983,7 @@ class PHPMailer
                    $isSent = true;
                }

-                $callbacks[] = ['issent' => $isSent, 'to' => $to[0]];
+                $callbacks[] = ['issent' => $isSent, 'to' => $to[0], 'name' => $to[1]];
            }
        }

@ -1986,7 +2004,7 @@ class PHPMailer
        foreach ($callbacks as $cb) {
            $this->doCallback(
                $cb['issent'],
-                [$cb['to']],
+                [[$cb['to'], $cb['name']]],
                [],
                [],
                $this->Subject,
@ -2167,7 +2185,8 @@ class PHPMailer
     * The default language is English.
     *
     * @param string $langcode  ISO 639-1 2-character language code (e.g. French is "fr")
-     * @param string $lang_path Path to the language file directory, with trailing separator (slash)
+     * @param string $lang_path Path to the language file directory, with trailing separator (slash).D
+     *                          Do not set this from user input!
     *
     * @return bool
     */
@ -2229,14 +2248,32 @@ class PHPMailer
            if (!static::fileIsAccessible($lang_file)) {
                $foundlang = false;
            } else {
-                //Overwrite language-specific strings.
-                //This way we'll never have missing translation keys.
-                $foundlang = include $lang_file;
+                //$foundlang = include $lang_file;
+                $lines = file($lang_file);
+                foreach ($lines as $line) {
+                    //Translation file lines look like this:
+                    //$PHPMAILER_LANG['authenticate'] = 'SMTP-Fehler: Authentifizierung fehlgeschlagen.';
+                    //These files are parsed as text and not PHP so as to avoid the possibility of code injection
+                    //See https://blog.stevenlevithan.com/archives/match-quoted-string
+                    $matches = [];
+                    if (
+                        preg_match(
+                            '/^\$PHPMAILER_LANG\[\'([a-z\d_]+)\'\]\s*=\s*(["\'])(.+)*?\2;/',
+                            $line,
+                            $matches
+                        ) &&
+                        //Ignore unknown translation keys
+                        array_key_exists($matches[1], $PHPMAILER_LANG)
+                    ) {
+                        //Overwrite language-specific strings so we'll never have missing translation keys.
+                        $PHPMAILER_LANG[$matches[1]] = (string)$matches[3];
+                    }
+                }
            }
        }
        $this->language = $PHPMAILER_LANG;

-        return (bool) $foundlang; //Returns false if language not found
+        return $foundlang; //Returns false if language not found
    }

    /**
--- a/e107_handlers/vendor/phpmailer/phpmailer/src/POP3.php
+++ b/e107_handlers/vendor/phpmailer/phpmailer/src/POP3.php
@ -46,7 +46,7 @@ class POP3
     *
     * @var string
     */
-    const VERSION = '6.4.0';
+    const VERSION = '6.5.0';

    /**
     * Default POP3 port number.
--- a/e107_handlers/vendor/phpmailer/phpmailer/src/SMTP.php
+++ b/e107_handlers/vendor/phpmailer/phpmailer/src/SMTP.php
@ -35,7 +35,7 @@ class SMTP
     *
     * @var string
     */
-    const VERSION = '6.4.0';
+    const VERSION = '6.5.0';

    /**
     * SMTP line break constant.
@ -186,6 +186,7 @@ class SMTP
        'Amazon_SES' => '/[\d]{3} Ok (.*)/',
        'SendGrid' => '/[\d]{3} Ok: queued as (.*)/',
        'CampaignMonitor' => '/[\d]{3} 2.0.0 OK:([a-zA-Z\d]{48})/',
+        'Haraka' => '/[\d]{3} Message Queued \((.*)\)/',
    ];

    /**
 @ -1 +1 @@
 .4.0
 .5.0