Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:26950
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 64.233.162.230 as permitted sender)
DomainKey-Status: good
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
        b=RiJ0Wum7YAp9mYmsZqex0x09MNt1cwlMW5IC2KK7aDPJZh323Rb6nFq9fiZH8uqY53IdKr5CwBuRYRtkDC3gAp+PRKTV8qn/Ytwn32kReXDKmCVwBrdNtQQb71i3mSkvOvJIvca35yjULFWn3Uxeyn9VjP1MJfoAGMdZoh0Kcmo=
Message-ID: <45812FC2.3050500@gmail.com>
Date: Thu, 14 Dec 2006 11:04:34 +0000
User-Agent: Thunderbird 1.5.0.8 (Windows/20061025)
MIME-Version: 1.0
To: Markus Fischer <markus@fischer.name>
CC: Ilia Alshanetsky <ilia@prohost.org>, 
 PHP internals <internals@lists.php.net>
References: <10536315-883E-4C1A-AF35-386DF4D73F84@prohost.org> <45807AC8.8020907@gmail.com> <515375DA-C752-4F5D-A244-3394C56846DA@prohost.org> <45808461.9070505@gmail.com> <98F4FCCE-94A0-448D-AA27-EABF7E82A7DB@prohost.org> <45812ABB.4060309@fischer.name>
In-Reply-To: <45812ABB.4060309@fischer.name>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] mail() logging for PHP
From: stuttle@gmail.com (Stut)

Markus Fischer wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Ilia Alshanetsky wrote:
>   
>>> I'm thinking about this from an ISP point of view... we get a lot of
>>> abuse reports because people have poorly written form handlers. It
>>> would be great if we could have PHP insert the full URL, domain name
>>> included, in the mail headers for anything it sends. Would that be
>>> possible?
>>>       
>> That is way too much information to include into an e-mail header, this
>> would in fact be information disclosure vulnerability in many eyes. The
>> log file that you can enable provides you with the full path to the
>> script that called mail, which is more then enough to identify the
>> offending script and/or application.
>>     
>
> In case someone would use a library installed on the server were the
> mail() call e.g. in /usr/lib/PEAR/lib/php/Mail/Transport/PHP_Mail.php
> (just an example) would this really help identifying the cause of the
> problem? No Domain, no URL, I think it would be hard to determine who
> used it.

Cracking point. Putting the domain in a header would make this far more 
useful, and I don't think that's too much info to include in a header. 
Ideally it would be the full URL, and I have to say that I don't think 
that's too much information for a mail header, and it's exactly what 
would be needed.

-Stut