As
the russians once said... "Many tanks." That will keep users from being
"locked out". In addition to waiting
for IPSwitch to come up with some fix, I'm going to try
loading <!--IMail.MailMessage--> into a CDATA field,
then
use the template to read/parse the mail
message. This will prevent the browser from getting to the
script
before I do. The only problem is going to be the overhead to
scrub the messages.
Your KWM templates rock, BTW. The IMail tags are a dog
to work with, but I'm glad they're there.
-Norm
Norm et.
al.,
You can
disable the automatic preview of messages in KillerWebMail by editing the
msgsum.html file. Find this block of code at about line
369:
function myLoad(){
// reset reload count, because user is
obviously
active
parent.refreshCount=0
if(parent.previewFrame){
<!--IMAIL.BeginIfMsgCount.EQ
0-->
parent.previewFrame.location.href="readfail.html?blank=yes"
<!--IMAIL.ElseBeginIfMsgCount-->
parent.previewFrame.location.href="rmail.<!--IMAIL.Number-->.cgi?mbx="+MailboxLink+"&msgsort="+z
<!--IMAIL.EndBeginIfMsgCount-->
}
}
and
comment out the reload lines (changes shown in red... one of the few times I
like html msgs to a list):
function myLoad(){
// reset reload count, because user is
obviously
active
parent.refreshCount=0
if(parent.previewFrame){
<!--IMAIL.BeginIfMsgCount.EQ
0-->
//parent.previewFrame.location.href="readfail.html?blank=yes"
<!--IMAIL.ElseBeginIfMsgCount-->
//parent.previewFrame.location.href="rmail.<!--IMAIL.Number-->.cgi?mbx="+MailboxLink+"&msgsort="+z
<!--IMAIL.EndBeginIfMsgCount-->
}
}
Note that the only
way to prevent this "hack" (embedded JavaScript commands) is for Ipswitch to
rewrite the iwebmsg service so it parses-out all JavaScript from the message
body before sending it to the browser.
Wow... it's a little worse in KWM. I just tried a
test on the [EMAIL PROTECTED]
address. Since
the preview for the first message in the Inbox comes up
automatically, you can't even read your other
mail. It just forwards you to the faux login page as soon as
you login. The only way to read the
rest of your mail is to send yourself another message (so the preview
for the malicious email doesn't
automatically kick in).
Does anyone else see this as a problem or is there some easy setting
that I'm not aware of to
neutralize this issue?
-Norm
Hi
again,
It
can now send the same type of email to KillerWebMail users, as well
as
default template users. Again, even if the login screen doesn't
use the same
template, all a malicious user has to do is cut&paste the
HTML off the login
page onto their own version.
Norman Nolasco
Advarion Incorporated
