procmail
[Top] [All Lists]

Re: Simple Mailserver troubles...

1997-09-03 13:31:05
Jari Aalto wrote:
:0
*^Subject:.*ntcsrv.*(gethelp|getlist)
* ? test -d $NTC_DIR
* !^X-Loop: $ALL_FROM
* !^Subject:.*Re:
* !^FROM_DAEMON
{
    MAILDIR = $NTC_DIR

    :0 c
    :*^Subject:.*ntcsrv +\/.*

    FILE="$MATCH"               # the requested filename

Other than the syntax errors which others have already pointed out, be aware
that you have a serious security hole here. Consider what would happen if I
sent you an e-mail with the subject "ntcsrv gethelp; rm -rf ~", for example.
Here's how I would plug this security hole:

Change

*^Subject:.*ntcsrv.*(gethelp|getlist)

to

* ^Subject:[    ]*ntcsrv[       ]+(gethelp|getlist)$

(That's a space and a tab inside those brackets.)

And change:

      :0 c
      :*^Subject:.*ntcsrv +\/.*

      FILE="$MATCH"               # the requested filename

to

      :0
      * ^Subject:[      ]*ntcsrv[       ]+\/(gethelp|getlist)
      { FILE = $MATCH }

(That will also fix another syntax error that nobody has mentioned so far.)

Later,
Ed

<Prev in Thread] Current Thread [Next in Thread>