Req #36341 [Com]: Changes to combat mail form spam

Edit report at https://bugs.php.net/bug.php?id=36341&edit=1 ID: 36341 Comment by: david at ols dot es Reported by: paul at xciv dot org Summary: Changes to combat mail form spam Status: Open Type: Feature/Change Request Package: Feature/Change Request Operating System: FreeBSD PHP Version: 4.4.2 Block user comment: N Private report: N New Comment: You can actually add custom parameters to sendmail using per vhost php_admin_value sendmail_path , nevertheless having the REMOTE_ADDR user ip address will be very helpful as it could be checked against spamhaus/cbl , also having REQUEST_URI available could help tracking problems. Request #37989 is a similar one. Previous Comments: ------------------------------------------------------------------------ [2006-03-08 19:59:40] richard at indigo3 dot net An interesting idea. Well worth the investment in time and effort. ------------------------------------------------------------------------ [2006-03-06 16:11:00] simon at advantage-interactive dot com Excellent suggestions, would help tracking back spam ------------------------------------------------------------------------ [2006-03-04 21:33:26] tim at globalgold dot co dot uk I agree Paul's suggestion should be implemented. ------------------------------------------------------------------------ [2006-02-11 18:33:41] karl at kdawebservices dot com Both excellant ideas. I also believe there is a patch out in the wild for PHP that automatically adds a X header with the vhost domain - Perhaps this should be incorporated (with an ini option to turn it on/off) along with adding the path to the script as an X header as well. ------------------------------------------------------------------------ [2006-02-09 15:16:05] paul at xciv dot org Description: ------------ I have two suggestions for modifications to help combat the problem of mail form spam. Firstly I would like to see mail.force_extra_parameters back-ported to the 4.x branch - not everyone is ready to upgrade to 5.x in production yet. Secondly I would like to suggest that environment variables from the PHP environment are exposed to the sendmail binary. I will explain why this is useful. Reproduce code: --------------- With the mail.force_extra_parameters option, I can set different parameters per Apache vhost. This can be very useful because I can set custom parameters like: -xs my.vhost.domain How is this useful? Well if I then set a new sendmail_path to my own custom wrapper script I can pick up these custom parameters and do two things: 1. Log the originating vhost, number of recipients etc. 2. Add an X-Header: in the mail detailing which vhost the mail originated from - before passing it to the real sendmail. This allows me to track which vhost sent mail from the httpd! So I can now track which vhost may have an insecure mail form if I get spam reports. With say 100 vhosts this is *invaluable*. My second suggestion would make this a lot easier and a lot more expandable. If the PHP environment variables were exposed to sendmail then I could even pick up such details as the script filename etc and this would then not require the use of custom mail.force_extra_parameters. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=36341&edit=1