Thanks for the catch, merlyn. But ...

if you examine the script closer, it is not mandating the use of any form fields to determine the recepient. Instead, the script is relying on internal config to determine these values. There's only an option to include the form field that is available to the user. Although, I admit, I may have to include a disclaimer about potential risks involved in using such form field. Yet, I did use similar script on some of my clients' internal company servers for feedback collection, in which case, a hidden form field containing recepient email address wouldn't pose any threat. This does appear to be a case of an older feature making it's way to the final revision. Which, as you pointed out, may not be a good thing.

In fact, the only form field "required" to run the script is the special _mf_ parameter. And even that may be omitted if the script is using the default config only. Also the parameter is retreived from the outside environment in a safe manner: 
    my $mf = $cgi->param('_mf_');
    $mf =~ s/\.\/\\//g; # remove . \ / chars
    $mf ||= "default";

[download]
The rest is and should be all configured via internal .conf files, further minimizing any outside tampering with the script. Additional security measure could be to taint check the rest of 'information' fields that are being sent along with the email.

conf/default.conf 
# smtp server
SMTP_HOST=mail.yourhost

SMTP_PORT=110

SMTP_TIMEOUT=60

# name form imputs which are lists (comma separated)
# FORM_INPUT_LISTS=

# recipient email
RECIPIENT=myemail@myhost.com

# sender field required
REQUIRE_SENDER=no

# sender field (from html form)
SENDER_FIELD=EMAIL

# subject (could contain html::template variables!)
SUBJECT=Contact From <TMPL_VAR NAME>, <TMPL_VAR COMPANY>

# mail template (to the recipient)
MAIL_TMPL=mail

#------------- CONFIRM ------------
# sender template (optional)
# mail to be sent to the sender
CONFIRM_MAIL_TMPL=mail_confirm

# subject of the confirmation email
CONFIRM_SUBJECT=Thank you for your interest in ...
# 
CONFIRM_REPLYTO=mycontact@myhost.com

#------------- OK -----------------
# redirect when mail was sent ok
#
REDIRECT_OK=/thankyou.shtml

# template to use on successful send
# (overrides redirect_ok)
# 
# TMPL_OK=<template path>

#------------- FAIL ---------------
# redirect when couldn't send mail and other non system errors
#
# REDIRECT_FAIL=<url path>

# template to use on failure
# (overrides redirect_fail)
#
TMPL_FAIL=fail

#----------- USER ERROR -----------
# template for usage error page
#
TMPL_USER_ERROR=user_error

# redirect url on user (usage) error
# (user_error_tmpl will be ignored)
#
# REDIRECT_USER_ERROR=<url path>

[download]
You are right on the other items though, and I admit script needs alittle rework around potential security holes.

And yet, despite of all said, I am baffled that having made the effort to package and give the script away, I'm simply asked to fold it back. It truly is a disappointing loss of my time ...

Please, don't take me wrong though. I do thoroughly appreciate the fact that unlike others who chose to -- this contribution, you actually made the effort and took some of your scarce time to include an explanation for doing so.


_____________________
"We've all heard that a million monkeys banging on a million typewriters will eventually reproduce
the entire works of Shakespeare. Now, thanks to the Internet, we know this is not true."

Robert Wilensky, University of California

In reply to Re^2: CGI Contact Form / Mailer by vladb
in thread CGI Contact Form / Mailer by vladb

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.