Details
Description
See forum discussion http://forum.civicrm.org/index.php/topic,21960
The change made for CRM-8744 prevents CiviCRM connecting to a SMTP server unless that server provides authentication in the clear. This is insecure.
Notes:
1) The latest version of http://pear.php.net/package/Net_SMTP doesn't include this patch (released 2013-07-05) which tells me it's not an important patch
2) The source of the patch http://www.pear-forum.org/post-4935.html has gone off-air so we can't see why this patch was made or assess how well it was tested etc
3) I can demonstrate (in the Forum discussion) that this patch breaks the code
4) This patch creates a security issue, because it forces people to authenticate SMTP in the clear