#36341 [Com]: Changes to combat mail form spam
ID: 36341
Comment by: karl at kdawebservices dot com
Reported By: paul at xciv dot org
Status: Open
Bug Type: Feature/Change Request
Operating System: FreeBSD
PHP Version: 4.4.2
New Comment:
Both excellant ideas. I also believe there is a patch out in the wild
for PHP that automatically adds a X header with the vhost domain -
Perhaps this should be incorporated (with an ini option to turn it
on/off) along with adding the path to the script as an X header as
well.
Previous Comments:
------------------------------------------------------------------------
[2006-02-09 15:16:05] paul at xciv dot org
Description:
------------
I have two suggestions for modifications to help combat the problem of
mail form spam.
Firstly I would like to see mail.force_extra_parameters back-ported to
the 4.x branch - not everyone is ready to upgrade to 5.x in production
yet.
Secondly I would like to suggest that environment variables from the
PHP environment are exposed to the sendmail binary.
I will explain why this is useful.
Reproduce code:
---------------
With the mail.force_extra_parameters option, I can set different
parameters per Apache vhost.
This can be very useful because I can set custom parameters like: -xs
my.vhost.domain
How is this useful? Well if I then set a new sendmail_path to my own
custom wrapper script I can pick up these custom parameters and do two
things:
1. Log the originating vhost, number of recipients etc.
2. Add an X-Header: in the mail detailing which vhost the mail
originated from - before passing it to the real sendmail.
This allows me to track which vhost sent mail from the httpd! So I can
now track which vhost may have an insecure mail form if I get spam
reports. With say 100 vhosts this is *invaluable*.
My second suggestion would make this a lot easier and a lot more
expandable. If the PHP environment variables were exposed to sendmail
then I could even pick up such details as the script filename etc and
this would then not require the use of custom
mail.force_extra_parameters.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=36341&edit=1
Thread (10 messages)