Where are the messages being sent?

Based on what you're saying in 'message substitutions', you're accepting as input the 'who to send to' type fields -- unless this is a 'mail this article to a friend' or similar, you typically don't need to take that sort of input from the user, as it's dependant on the submission form.

In the case where we were hosting the script for users on the system, I had users create configuration files (which contained required fields, message formatting rules, recipients, response to the submitter, etc), and they passed enough information to the system for it to locate their configuration file (user name, and path from their home directory).

This way, we could allow users on the system to use the script, while rejecting it being used as a backend for unaffiliated persons. (and so long as users have write access to the system, it's much more effective than referrer ... you could probably pass in a URL to get the configuration file, and have an acceptable pattern, and cache, but it's going to be much more complicated)

If you're allowing visitors to specify the recipient (e-cards, mail this article, etc.), I'd probably use rate limiting by IP, and some more general rate monitoring (if I see a sudden spike in usage, it might be an issue, even if it's coming from multiple IP addresses). I might also do some sort of monitoring of 'added' body content, if it's acceptable by the security rules, so that I can see if the the same/similar message body is being repeated over and over again.

In reply to Re: Securing mailing scripts by jhourcle
in thread Securing mailing scripts by sulfericacid

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.