Good morning,
I'm a Roundcube newbie who is currently working on some minor plugins to
adapt Roundcube to our needs.
One of our requirements is the ability to disable outgoing mail on
accounts compromised by spammers after someone falls for a phishing spam.
The attached plugin is close to what I need, other than the fact that the
user doesn't get any feedback to indicate that email has been disabled.
Should I be using something other than rcmail::raise_error() to stop
Roundcube in its tracks and generate an error page?
Thanks,
--
David Carter Email: [email protected]
University Computing Service, Phone: (01223) 334502
New Museums Site, Pembroke Street, Fax: (01223) 334679
Cambridge UK. CB2 3QH.
/* ================================================================== */
class hermes_ratelimit extends rcube_plugin
{
public $task = 'mail';
private $max_recipients = 1000;
public function init()
{
$this->add_hook('message_before_send',
array($this, 'message_before_send'));
}
public function message_before_send($p) {
$username = $_SESSION['username'];
# XXX Should check if $username compromised in previous login session
here.
$mailto = $p['mailto'];
$recips = explode(",", $mailto);
$count = count($recips);
if (isset($_SESSION['recip_count'])) {
$_SESSION['recip_count'] = $_SESSION['recip_count'] + $count;
} else {
$_SESSION['recip_count'] = $count;
}
if ($_SESSION['recip_count'] >= $this->max_recipients) {
error_log("hermes_ratelimit: " . $username .
" reached limit of " . $this->max_recipients);
# XXX Should add $username to database blacklist here
rcmail::raise_error
(array('code' => 800, 'type' => 'smtp', 'message' =>
"Compromised account? Outgoing email disabled!"
), true, true);
}
}
}
_______________________________________________
Roundcube Development discussion mailing list
[email protected]
http://lists.roundcube.net/mailman/listinfo/dev
