Elxis CMS Forum

Support => Elxis 4.x/5.x DEV => Topic started by: seadhna on January 09, 2024, 17:02:03

Title: apostrophe in SMTP password
Post by: seadhna on January 09, 2024, 17:02:03

Hi there,
we are able to send a test email successfully using SMTP, but there is an apostrophe in the password, and when we try to save out of SETTINGS, we get the error message:

Parse error: syntax error, unexpected single-quoted string ";", expecting "," or ";" in /home/clients/[REDACTED]/web/configuration.php on line 66

We are unable to change the password.

Is there any way around this? We have tried 1) escaping with a backslash, 2) encoding the apostrophe as ' 3) using double quotes everywhere except the password in the configuration file.
Unfortunately none of these methods work.

Thanks for any help. Unfortunately, we have no control over the password and cannot change it.

Title: Re: apostrophe in SMTP password
Post by: datahell on January 11, 2024, 20:19:51

A password is a string. All strings that comes from user input (POST/GET/etc) pass through the sanitizeInput method of the Elxis framework. Method sanitizeInput, among others, converts single and double quotes to ' and " respectively. So, when ever you try to use a quote in SMTP password then instead of this hi'world this will be saved: hi'world
Meaning that the password will be wrong. Therefor you cannot use quotes in passwords. Actually avoid all symbols in all passwords like $#'"\`*<>% because in many cases they are treated as dangerous characters.

You can bypass this problem the following way:
Open file configuration.php and locate MAIL_SMTP_PASS
Type your password and use a backslash to escape the single quote. Example: That\'sok!
Save the file.

NOTE 1: After that you cannot use the Save/Apply functionality for saving the configuration via Elxis. You must manually edit it each time.
NOTE 2: I just made a change which will add automatically backslashes in such cases. So, on the next Elxis update the problem will be solved and you will not have to manually edit the configuration.php file each time.

Title: Re: apostrophe in SMTP password
Post by: seadhna on January 12, 2024, 11:35:38

Thanks for this explanation and future fix! Note 1 is a good solution for now. This is good to know whenever automatically generating passwords, to exclude apostrophes as a general rule.