in reply to Securing mailing scripts

What do you mean by "sending out"? Do you want the visitor to be able to configure the recipient or do you want to use a fixed one?

If you _need_ it "open", I'd require at least registration, and use a strict check of the mailaddress that it must match against, not just a search for malicious contents.

Maybe you could get a bit more clear on what you're on to? :)
Ordinary morality is for ordinary people. -- Aleister Crowley

Replies are listed 'Best First'.
Re^2: Securing mailing scripts
by sulfericacid (Deacon) on Sep 15, 2005 at 15:17 UTC
    This is a fixed script. Imagine that the only fields YOU as the USER can set are EMAIL, SUBJECT and MESSAGE. These are all the text fields on the form side that you are able to set.

    The TO: section is hard coded into the script. This is just a contact form to request more information. I'm just looking for the best ways to secure it. I'd use SSL but unfortunately I can't afford it right now.

    Thank you.



    "Age is nothing more than an inaccurate number bestowed upon us at birth as just another means for others to judge and classify us"

    sulfericacid
[reply]
      How would SSL help you? That would only secure what people want to send your script.

      If you don't allow the "To:" to be set by the visitor that's making it a bit easier :) Just don't send a copy to the address the visitor states to use in the "From:", as this could be misused too.

      A few other ideas:
      • You might want to use a "(un)check this option to prove you're not a script"-checkbox. This at least knocks out the poorly written scripts.
      • Check all fields strictly. Think about the possibilities for an attacker if he finds out he can add newlines to the header section of the generated mails ;)
      • If you use other people's scripts, check the code.

      This is by all means definitely absolutely not complete.
      Ordinary morality is for ordinary people. -- Aleister Crowley
[reply]

      In your original post you said you're filtering "To"; now you say "To:" is hardcoded.

      For preventing mass mailing you may generate pictures on the fly and ask the "USER" to complete a field of the form with the content of the picture (text or number)

      There's no point in using SSL unless you want to protect the contents of the message or you are using some means of auth (user/pass secret key etc) which I don't think is the case.

      Dodge This!
[reply]

In Section Seekers of Perl Wisdom