Re: Re: CRLF Injection in mail()

>> NO! They'll get a Bcc: on the *ONE* email they sent with your FORM. > >It depends on your form. If you have a "contact the admins" form, then >they can find out your email. Or say you are running an AA help group They can already find out my email[s] from harvesting it here :-^ >and you provide a way for people to email each other through the web. >Someone can type in a message and then your PHP script send out a >message to each of the members, but the message is from your web site, >not the person, so their identities are hidden, for privacy reasons. Now >if I put in a contaminated Subject, I can get CC:d on EVERY email that >the script sends out at that time. I can find out everyone's email >address. How are you protecting the privacy of your users? I use Bcc: on all of them, of course. How else would you do it? >> Since they *SENT* the email, that does not seem like much of an issue >to >> me. > >It's not the content they would be after, it would be finding out the >email addresses of the recipients. The only email they get is mine, which, like, already gets so much spam it just doesn't matter any more. Sigh. >This is something that 99% of the people out there aren't going to think >about. Look at all the problems already with cross-site scripting. It's >an easy fix, yes, once you know about it, but I think it could be better >handled at the PHP core level. > >Is there ever a need to let someone set additional headers in the >Subject part of mail()? Why allow people the change to do it and have >unwanted consequences when it's easily fixed for everyone? Apply for a CVS account and fix it, then. :-) -- Like Music? http://l-i-e.com/artists.htm