I found a bug in qmailadmin (as far back as at least 1.0.6, and possibly
earlier) that relates to forwarding to a pipe and modifying that user with
qmailadmin.
The issue is given a users .qmail file with the following line:
| /usr/local/bin/maildrop ./.mailfilter
After modifying the user via qmailadmin, the .qmail file becomes
&|/usr/local/bin/maildrop
&./.mailfilter
and all mail bounces with a fatal error.
This behavior is reproducible, and is not tied to a particular user.
When qmailadmin parses the form submission, it looks at the value submitted
for "Forward To", splitting the string at either a space, a comma, a
semi-colon or a newline, on the assumption that only email addresses would
be listed in that field.
The solution, while not perfect, handles the current situation much better.
We have removed the space from the list of acceptable delimiters, and now
only split the string at a comma, semi-colon or newline. This could
potentially break if a pipe to a command includes a comma, but we feel this
has a very low probability of happening.
After splitting the submitted string, we then check to see if the first
character is a space (so if somebody types "[EMAIL PROTECTED], [EMAIL PROTECTED]", we're not
putting the space in the forward and breaking other things). If it is a
space, we remove it. Next, we check the first character to see if it's a
unix pipe ("|") character. If it is, we write that token out to the .qmail
file unmodified. If not, we prepend a & to the string and write it out to
the .qmail file.
The only situation we can imagine where this method will break is if a comma
needs to be passed as an argument to a program that a message is being piped
to. Again, we feel this to be a rare possibility and worth the risk for a
simple and elegant solution.
The following patch was developed by Joshua Megerman
([EMAIL PROTECTED]), one of the partners of CTS. This is against
1.0.10, but it should be easy to backport to other versions.
--- user.c 2003-02-10 15:35:25.000000000 -0500
+++ user.c.new 2003-02-10 15:32:43.000000000 -0500
@@ -889,11 +889,19 @@
snprintf(NewBuf,156,"%s/.qmail", vpw->pw_dir);
fs = fopen(NewBuf,"w+");
- tmpstr = strtok(box," ,;\n");
+ /* original line follows - space delimiter removed
+ tmpstr = strtok(box," ,;\n"); */
+ tmpstr = strtok(box,",;\n");
+
+ /* added to ensure no spaces at the beginning of e-mail addresses */
+ while( *tmpstr == ' ')
+ tmpstr++;
count=0;
while( tmpstr != NULL && count < 2) {
- fprintf(fs,"&%s\n", tmpstr);
+ /* original line follows - added check for pipes
+ fprintf(fs,"&%s\n", tmpstr); */
+ fprintf(fs,"%s%s\n", (*tmpstr=='|' ? "" : "&"), tmpstr);
tmpstr = strtok(NULL," ,\n");
++count;
}
Dave Weiner
Partner, Coyote Technical Services
[EMAIL PROTECTED]
