Web Hosting Talk







View Full Version : FormMail question... need help... will pay.


Mekhu
06-09-2003, 01:09 AM
Getting spam going out through a client acocunt... but not him doing it... very odd.

I am thinking someone is spamming a script he uses but not sure. If this makes any sense, can someone MSN me jeff@presage-designs.com and offer some help.

I got a little cash in my paypal if you can help me solve.

xAngelx
06-09-2003, 01:15 AM
Simple, remove the formail.cgi and formmail.pl scripts. Have your clients use a php mail script instead.

Mekhu
06-09-2003, 01:17 AM
Ok, it is php... so it can't be it then?

xAngelx
06-09-2003, 01:19 AM
Sure it can, they aren't perfect either. Which script is it and what version?

Mekhu
06-09-2003, 01:21 AM
ok, thanks so much for this help... I've posted it below... if this was the wrong way to post code (never done it before), just let me know.


<?php
$font="<FONT face='Verdana,Arial,Helvetica' color=#0000ff>";
$today = date("Y-m-d H:i:s");
$to ="$mail_recipient";
$subject ="$mail_subject";
$from ="$mail_from";
$formpage =$_SERVER["HTTP_REFERER"];
$extraHeaders ="From: $from\nMIME-Version: 1.0\nContent-Type: text/html\n\n";
$message ="${font}Submitted from $formpage on $today (Server time).<p>\n";
$message .= "\n<table border=2 cellpadding=5 cellspacing=5>"; // comment if no <table>

while ($array_cell = each($HTTP_POST_VARS)) // $_POST
{
if ( $array_cell['key'] == 'mail_from') continue;
if ( $array_cell['key'] == 'mail_recipient') continue;
if ( $array_cell['key'] == 'mail_subject') continue;
if ( $array_cell['key'] == 'mail_nextpage') continue;

$message .= "<tr><td>".$array_cell['key']."</td><td>".stripslashes($array_cell['value'])."</td></tr>"; // comment if no <table>
}
$message .= "</table><p>"; // comment if no <table>

mail("$to", "$subject", "$message", "$extraHeaders");
echo "<meta http-equiv=\"refresh\" content=\"0;url=$mail_nextpage\">";

?>

xAngelx
06-09-2003, 01:40 AM
Uh prolly not a good idea to post code here on the forum. But that's not the code I was referring too. What script does he use to process it? (looks to me like a script called formpage)

Email it to me and I'll get one of my guys on it for you (I'm going out for a bit).

Mekhu
06-09-2003, 01:43 AM
That is the processing script.

xAngelx
06-09-2003, 01:44 AM
Ok, Rachel's got ya covered till I get back.

Mekhu
06-09-2003, 01:51 AM
Insanely nice of you.

bitserve
06-09-2003, 05:28 AM
That php script doesn't even check the referer, which makes it ten times worse than even FormMail 1.3 (01/21/96). It's definitely a potential spam target.

Try looking at some of these for reference:

http://php.resourceindex.com/Complete_Scripts/Form_Processing/

Winkie
06-09-2003, 05:59 AM
Solution:

Remove the PHP script, tell him to rewrite it to only accept mail under certain circumstances (originating IP address etc, referer URL plus a database session)

If he puts it back up without your permission, terminate account.

That's completely open to spam afaik

xAngelx
06-09-2003, 09:22 AM
No worries guys, we wrote em one last night and sent it to him.

Mekhu
06-09-2003, 01:41 PM
Thanks again everyone.

xAngelx, was extremely kind enough to help me pinpoint all the issues with the script and also provide me with a very secure one which my client is implementing right now.

Regards,
Jeff Piper