Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:10225
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <20040601172614.5493.qmail@pb1.pair.com>
To: internals@lists.php.net
References: <024e01c4464c$f8dbf500$0200a8c0@rusko> <200405301333.34754.ilia@prohost.org> <02c001c4466f$6aa3cb50$0200a8c0@rusko> <200405301407.19977.ilia@prohost.org> <02d801c44674$1a3d4470$0200a8c0@rusko>
Date: Tue, 1 Jun 2004 10:06:24 -0700
Lines: 19
Subject: Re: [PHP-DEV] [patch] abuse-proof zif_mail()
From: pollita@php.net ("Sara Golemon")

> when it comes to mail(), it is a whole different story. if i disabled
mail()
> on just one box today, a *lot* of people would complain and with good
> reason - the collateral inflicted by something that drastic (ie disabling
a
> very popular function to protect against a relative edge case) is way out
of
> line. i am not an anti-spam fanatic, the clients' requirements come first.
>
The whole matter is moot because no matter how aggressively you block access
to mail(), sendmail, et. al.  The user can still make socket calls directly
using SMTP commands.  The protocol is not hard to understand and it's the
neerdowells that you're talking about stopping not the innocent accidentals.

-Sara

"Locks are to keep the honest people honest."