Obfuscate X-Php-Originating-Script

Question

If there is no access to php.ini (assume php -v >= 5.3 & mail.add_x_header = 1), or a way to patch mail, is there a way to change the X-Php-Originating-Script header when using php's mail() function?

The little research I did indicated that altering $_SERVER['PHP_SELF'] prior to calling mail() would do the trick, however this did not work for me.

I also tried setting X-Php-Originating-Script directly, this resulted in an additional 'X-Php-Originating-Script' header.

The goal in this case is to prevent recipients of said email to gleam details on script nomenclature.

Thanks!

Answer 1

According to the PHP Manual (PHP Manual >> Function Reference >> Mail Related Extensions >> Mail >> Installing/Configuring) that header can be turned off using php.ini or .htaccess file which would prevent anyone from gleaning information from your mail headers without you having access to your php.ini file.

The setting to turn it off is:

mail.add_x_header bool

Add X-PHP-Originating-Script that will include UID of the script followed by the filename.

which would make the actual line needed to disable it:

 mail.add_x_header 0

This setting is flagged with the PHP_INI_PERDIR mode (Available since PHP 5.3.0). PHP_INI_PERDIR means that the "Entry can be set in php.ini, .htaccess, httpd.conf or .user.ini (since PHP 5.3)."

For .htaccess:

php_flag mail.add_x_header Off

I have not personally tested this so YMMV.