# PHP mail() header patch for SafeMode

- Thread: https://externals.io/message/35551
- Original archive: https://news-web.php.net/php.internals/35551
- Started by Paul van Brouwershaven on 2008-02-18T11:06:32+00:00
- Messages: 8
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #35551 — Paul van Brouwershaven — 2008-02-18T11:06:32+00:00

URL: https://externals.io/message/35551#35551

Hi All,

I'm working for an hosting company, we have a lot of PHP users and see regularly that one of the 
scripts from our users is hacked. Result?, a lot of spam on the net, and a lot of work the find the 
spamming scripts on the servers.

If you have a PHP script that sends mail, the recipient of the mail message will only see which 
server it was sent from. There will normally be no record of who originated the message, or which 
script on the server actually caused it to be sent. This can make it difficult to trace misuse, even 
if you have comprehensive mail and webserver logs.

I think it should be usefull to add the "PHP `mail()` header patch" from Steve Bennett in safemode by 
default.

The header could be in the form:

     X-PHP-Script: <servername><php-self> for <remote-addr>

For example:

     X-PHP-Script: www.example.com/~user/testapp/send-mail.php for 10.0.0.1

The patch can be found at:

http://www.lancs.ac.uk/~steveb/patches/php-mail-header-patch/

Best Regards,

Paul van Brouwershaven

---

## #35552 — Markus Fischer — 2008-02-18T13:48:57+00:00

URL: https://externals.io/message/35551#35552 · In reply to: #35551

Hey,

Paul van Brouwershaven wrote:
> I think it should be usefull to add the "PHP `mail()` header patch" from 
> Steve Bennett in safemode by default.

I wonder how this would go along with: 
http://www.php.net/~derick/meeting-notes.html#safe-mode

I don't know if this still applies, it's from 2005 ...

- Markus

---

## #35553 — Lars Strojny — 2008-02-18T13:49:47+00:00

URL: https://externals.io/message/35551#35553 · In reply to: #35551

Hi Paul,

Am Montag, den 18.02.2008, 12:06 +0100 schrieb Paul van Brouwershaven:
[...]
> I think it should be usefull to add the "PHP `mail()` header patch" from
> Steve Bennett in safemode by default.

As safemode is going to be (finally!) removed in PHP 6, I would propose
not to make this dependent on safe-mode. I would rather allow this
feature to be enabled separetely in the php.ini. Something like
mail.extra_log_header (not the perfect name, I know) would work.
[...]

cu, Lars

---

## #35554 — Paul van Brouwershaven — 2008-02-18T14:04:24+00:00

URL: https://externals.io/message/35551#35554 · In reply to: #35553

Hi Lars & Markus,

Lars Strojny wrote:
> As safemode is going to be (finally!) removed in PHP 6, I would propose
> not to make this dependent on safe-mode. I would rather allow this
> feature to be enabled separetely in the php.ini. Something like
> mail.extra_log_header (not the perfect name, I know) would work.
> [...]

Enabling it from the php.ini would also be a good option, the main point is to get some help with 
tracking the spam source in a shared hosted environment.

---

## #35555 — Cristian Rodriguez — 2008-02-18T14:10:39+00:00

URL: https://externals.io/message/35551#35555 · In reply to: #35554

2008/2/18, Paul van Brouwershaven <paul@vanbrouwershaven.com>:

> Enabling it from the php.ini would also be a good option, the main point is to get some help with
> tracking the spam source in a shared hosted environment.

IIRC Ilia had a better patch for this, I dont know why it hasnt been
merged into PHP core.

-- 
http://www.cristianrodriguez.net

---

## #35556 — Lukas Kahwe Smith — 2008-02-18T14:11:03+00:00

URL: https://externals.io/message/35551#35556 · In reply to: #35554

> Hi Lars & Markus,
>
> Lars Strojny wrote:
> > […]
>
> Enabling it from the php.ini would also be a good option, the main  
> point is to get some help with tracking the spam source in a shared  
> hosted environment.


Are you aware of the following:
http://ilia.ws/archives/149-mail-logging-for-PHP.html

regards,
Lukas

---

## #35557 — Paul van Brouwershaven — 2008-02-18T14:19:11+00:00

URL: https://externals.io/message/35551#35557 · In reply to: #35556

Lukas Kahwe Smith wrote:
> Are you aware of the following:
> http://ilia.ws/archives/149-mail-logging-for-PHP.html

The idea is the same, but why is this not in the core?

---

## #35584 — Paul van Brouwershaven — 2008-02-19T11:17:35+00:00

URL: https://externals.io/message/35551#35584

Daevel wrote:
> Hello,
> 
> without any patch you can modify the "sendmail_path" parameter and add 
> what you want no ?
> 
> With mod_php I use this in my virtualhosts :
>    php_admin_value sendmail_path "/usr/sbin/sendmail -t -i -f 
> XXXX@DDDDD.TTT"
Yes, I have done this.. but now is the question where is the spamming script?

> An with CGI module, we already have the username.
> 
> It should be enough to identify which member is involved ; no ?
Yes, but not to identify which the script