Re: [Nms-cgi-devel] Suggestions for FormMail.pl

[Jonathan S. <jn...@ge...>]

On Thu, 2006-03-02 at 20:48, Steven Mackenzie wrote:
> Hi Jonathan,
> 
> One of my proposed changes: one liners for FormMail.pl and FormMail.pm,
> at the bottom of this message. If you really need patches, then can you
> let me know how you like them made?

The output of diff -Bub oldversion newversion is best so we can see
exactly what is changed.

> 
> There is a widely reported problem where SpamAssassin flags the results
> of NMS FormMail submissions as "BUGGY_CGI", after an inspection of the
> X-Mailer header. This does not apply to the confirmation emails, only to
> the submitted data. See for example,
> http://news.spamcop.net/pipermail/spamcop-mail/2003-July/009795.html
> which describes the SpamAssassin checks.
> 

Yes we keep sending them patches to fix this and they either change
something or forget to apply the patches.  Of course this isn't really a
'problem' unless you have locally configured your the score for
BUGGY_CGI to be higher than it is, alternatively you can whitelist the
mails in a number of ways within SpamAssassin.


> Looking at the code in FormMail.pm, confirmation emails are sent with a
> string made from a hard-coded part and the module version number, see
> FormMail.pm, Line 1282
>     $self->mailer->newmail("NMS FormMail.pm v$VERSION",
> $self->{CFG}{postmaster}, $email);
> 
> This string is matched by the SpamAssassin regex, and will not be
> flagged as BUGGY_CGI.
> 
> However, the submitted data is sent using the name_and_version string
> defined in FormMail.pl, which is different.
> 
> FormMail.pl: Line 94
>      name_and_version       => 'NMS FormMail 3.14m1',
> 
> Although this string is in the "non modifyable" section of FormMail.pl,
> it can be overridden in user config, by for example
> $more_config{name_and_version} = "My Mail Form";
> 
> I want to modify this because I am trying to get some extra obscurity by
> changing the value of my X-Mailer header, so I don't want NMS formmail
> advertised in my confirmation emails.
> 

I'm not sure what this buys you really, I hope you aren't thinking that
this is buying you any extra security or something.

> This string (usually with its default value) is used in FormMail.pm,
> Line 1057
>   $mailer->newmail($self->name_and_version, $self->{CFG}{postmaster}, @{
> $self->{Recipients} });
> 
> Mails to the scripts coded recipient are sent using this X-Mailer name,
> and will be flagged as BUGGY_CGI if SpamAssassin gets a sniff of them.
> 
> My first proposed change is that the default string at FormMail.pl line
> 94 should match the SpamAssassin regex, so should be
> FormMail.pl: Line 94:
>      name_and_version       => 'NMS FormMail.pl v3.14m1',
> 

I think the confirmation email should be fixed to use
$self->name_and_email() and the input to the constructor should set the
'name_and_version' to "NMS FormMail.pl v$VERSION"

> My second proposed change is that the configured X-Mailer name should be
> used in the confirmation and the submission emails. version number, see
> FormMail.pm, Line 1282
>     $self->mailer->newmail($self->name_and_version,
> $self->{CFG}{postmaster}, $email);
> 

Yes, I'm not quite sure why there is the different usage to be honest.

> Obviously I've changed my install so I'm happy, but it would be helpful
> for all the people confused that their NMS emails are being flagged as
> buggy! Any thoughts?
> 

I can't see any problem with this - I'll stick them in the code and
they'll be in the next release.

> Regards,
> Steven
> 
> 
> Jonathan Stowe wrote:
> 
> >On Thu, 2006-03-02 at 16:44, Steven Mackenzie wrote:
> >  
> >
> >>Hello,
> >>
> >>I have made some small changes to my FormMail.pm installation to use the
> >>configured Mailer name consistantly, avoid mails being flagged as spam
> >>by SpamAssassin, and to add a content type header that respects the
> >>users configured character set.
> >>
> >>I see the FormMail script hasn't been updated in a while though. Is
> >>anyone interested in adding these changes (in while case I'll describe
> >>and justify them)?
> >>    
> >>
> >
> >FormMail hasn't been changed in a while because it hasn't had any bugs
> >to be fixed and we are not encouraging adding new features - we are
> >concentrating any new development in TFmail as we aren't constrained by
> >the legacy of compatibility with the MSA FormMail.
> >
> >However if you send us a patch against the modules version of FormMail
> >we can take a look and discuss it.
> >
> >/J\
> >
> >  
> >
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by xPML, a groundbreaking scripting language
> that extends applications into web and mobile media. Attend the live webcast
> and join the prime developer group breaking into this new coding territory!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
> _______________________________________________
> Nms-cgi-devel mailing list
> Nms...@li...
> https://lists.sourceforge.net/lists/listinfo/nms-cgi-devel
-- 

This e-mail is sponsored by http://www.integration-house.com/