Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:26954
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain computel.nl from 83.137.20.15 cause and error)
Message-ID: <005001c71f71$5e877690$64c8a8c0@balefirehome>
To: "Markus Fischer" <markus@fischer.name>,
	"Ilia Alshanetsky" <ilia@prohost.org>
Cc: "Stut" <stuttle@gmail.com>,
	"PHP internals" <internals@lists.php.net>
References: <10536315-883E-4C1A-AF35-386DF4D73F84@prohost.org> <45807AC8.8020907@gmail.com> <515375DA-C752-4F5D-A244-3394C56846DA@prohost.org> <45808461.9070505@gmail.com> <98F4FCCE-94A0-448D-AA27-EABF7E82A7DB@prohost.org> <45812ABB.4060309@fischer.name>
Date: Thu, 14 Dec 2006 12:16:57 +0100
Organization: Computel Standby BV
MIME-Version: 1.0
Content-Type: text/plain;
	format=flowed;
	charset="iso-8859-1";
	reply-type=original
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] mail() logging for PHP
From: s.steffann@computel.nl ("Sander Steffann")

Hi,

>> That is way too much information to include into an e-mail header, this
>> would in fact be information disclosure vulnerability in many eyes. The
>> log file that you can enable provides you with the full path to the
>> script that called mail, which is more then enough to identify the
>> offending script and/or application.
>
> In case someone would use a library installed on the server were the
> mail() call e.g. in /usr/lib/PEAR/lib/php/Mail/Transport/PHP_Mail.php
> (just an example) would this really help identifying the cause of the
> problem? No Domain, no URL, I think it would be hard to determine who
> used it.

True. Maybe adding both the main-script-name and the name of the script that 
contains the mail() call might be a good idea. Another solution would be to 
apply encryption to the information. Then you could put much more 
information in the extra header without disclosing anything. You could even 
put all this in:
- Timestamp
- Server hostname
- IP address of the client invoking the script
- Requesting URL, including query string
- Full path+filename of the main script
- Full path+filename of the script that calls mail()
- etc

Put all this is a nice text, encrypt it (i.e. 3DES, or even RSA/DSA), base64 
encode it, and add it in a header. The header might be a little big, but I 
don't think that will be a big problem for those who want to use it.

A small example:

Put the following information in the extra header:

1166094481
www.computel.nl
83.137.22.2
http://www.computel.nl/stuff/bla.php?mailto=sander@steffann.nl
/var/www/sites/www.computel.nl/stuff/bla.php
/usr/lib/PEAR/lib/php/Mail/Transport/PHP_Mail.php

Encrypt this with 3des, using password 'something'. (the password could be 
configured in php.ini, or per virtual host):

U2FsdGVkX18+F3ghXdsE6Wkv0mJwtes2Ue0jMHrKfM+vNODH592rrEMZpDdbPtIe
vkSnERInTNA86XqZQtlQV+JJneAJexeNWKqhxRh+QHSsishzrq0+l9gfhu9G06LR
X3SrZCXtg9irvGIdA1OD5sDkUi7NJTJ7GnrJd6fnrv3wGZTAQlwjIeFm7LRSl8N+
tpkQckXfXYhVzOkGMU6/InE9q3Wo228wkazmXZKW1k1GVYtXPJL7f0JS9DMa3gEr
lJR5rnZqNcBVtCW6eVVl9jYU2g58bZLV

This can be put directly into a header in the message. The total extra 
message size would be about 300 bytes. That should be no problem at all. I 
have seen bigger received: headers in a message.

I think this would help a system admin a lot when trying to figure out where 
all those annoying messages are coming from. What do the rest of you think 
about this?

Thanks,
Sander

PS: If you need help implementing it, let me know!