civicrm/civicrm-packages — pull request #66 by kenwest (2014-06-07 14:17:07+00:00)
Title: CRM-14814 CRM-8744 breaks on SMTP svrs requiring secure authentication

See forum discussion http://forum.civicrm.org/index.php/topic,21960

The change made for CRM-8744 prevents CiviCRM connecting to a SMTP server unless that server provides authentication in the clear. This is insecure.

Notes:
1) The latest version of http://pear.php.net/package/Net_SMTP doesn't include this patch (released 2013-07-05) which tells me it's not an important patch
2) The source of the patch http://www.pear-forum.org/post-4935.html has gone off-air so we can't see why this patch was made or assess how well it was tested etc
3) I can demonstrate (in the Forum discussion) that this patch breaks the code
4) This patch creates a security issue, because it forces people to authenticate SMTP in the clear