From d54768332cb85cbf9a4964ff639c75858976a7d2 Mon Sep 17 00:00:00 2001
From: Peter Wilson <wilson@peterwilson.cc>
Date: Wed, 12 May 2021 22:25:58 +0000
Subject: [PATCH] External libraries: Improve attachment handling in PHPMailer

Props: audrasjb, ayeshrajans, desrosj, peterwilsoncc, xknown.
Partially merges [50799] to the 5.6 branch.


Built from https://develop.svn.wordpress.org/branches/5.6@50848


git-svn-id: http://core.svn.wordpress.org/branches/5.6@50457 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/PHPMailer/PHPMailer.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/wp-includes/PHPMailer/PHPMailer.php b/wp-includes/PHPMailer/PHPMailer.php
index 31646b2a84..6148ece326 100644
--- a/wp-includes/PHPMailer/PHPMailer.php
+++ b/wp-includes/PHPMailer/PHPMailer.php
@@ -1761,7 +1761,8 @@ class PHPMailer
      */
     protected static function isPermittedPath($path)
     {
-        return !preg_match('#^[a-z]+://#i', $path);
+        //Matches scheme definition from https://tools.ietf.org/html/rfc3986#section-3.1
+        return !preg_match('#^[a-z][a-z\d+.-]*://#i', $path);
     }
 
     /**
@@ -1773,12 +1774,15 @@ class PHPMailer
      */
     protected static function fileIsAccessible($path)
     {
+        if (!static::isPermittedPath($path)) {
+            return false;
+        }
         $readable = file_exists($path);
         //If not a UNC path (expected to start with \\), check read permission, see #2069
         if (strpos($path, '\\\\') !== 0) {
             $readable = $readable && is_readable($path);
         }
-        return static::isPermittedPath($path) && $readable;
+        return $readable;
     }
 
     /**