Re: Help needed with here documents (security?)

2013-10-24 Thread Octavian Rasnita
From: "Ronald F. Guilmette" > > In message <7E7181F2497441C88988DD1F16E4A743@octavianf303f0>, you wrote: > >>From: "Janek Schleicher" >> >>> Am 24.10.2013 15:07, schrieb Shawn H Corey: > my $email = Email::Simple->create( > header => [ > From => $sender_addr

Re: Help needed with here documents (security?)

2013-10-24 Thread Ronald F. Guilmette
In message <20131024183255.3c233104@sage>, you wrote: >On Thu, 24 Oct 2013 14:55:51 -0700 >"John W. Krahn" wrote: > >> stdin (and stdout) are part of a stream protocol and as such are not >> about files and do not signal End-Of-File which is part of why emails >> use the single period to signa

Re: Help needed with here documents (security?)

2013-10-24 Thread Ronald F. Guilmette
In message <52699767.2050...@shaw.ca>, you wrote: >Ronald F. Guilmette wrote: >> In message<5268663c.4040...@stemsystems.com>, >> Uri Guttmanwrote: >> >>> i think a blank line with . will end input to smtp servers. try that too >>> in the line after the from field. >> >> DING DING DING!!! >> >> G

Re: Help needed with here documents (security?)

2013-10-24 Thread Shawn H Corey
On Thu, 24 Oct 2013 14:55:51 -0700 "John W. Krahn" wrote: > stdin (and stdout) are part of a stream protocol and as such are not > about files and do not signal End-Of-File which is part of why emails > use the single period to signal the end of the message. I thought that was from the old mai

Re: Help needed with here documents (security?)

2013-10-24 Thread John W. Krahn
Ronald F. Guilmette wrote: In message<5268663c.4040...@stemsystems.com>, Uri Guttmanwrote: i think a blank line with . will end input to smtp servers. try that too in the line after the from field. DING DING DING!!! Give that man a cupie doll, because he's the winner of today's perplexing pu

Re: Help needed with here documents (security?)

2013-10-24 Thread Jim Gibson
On Oct 24, 2013, at 11:59 AM, Ronald F. Guilmette wrote: > But, getting back to my original 2 questions... > > I want to stress that I did not ask how to formulate and/or send a > properly formatted e-mail message. I can handle that part, even if > perhaps only in my own clumsey way. > > What

Re: Help needed with here documents (security?)

2013-10-24 Thread Ronald F. Guilmette
In message <7E7181F2497441C88988DD1F16E4A743@octavianf303f0>, you wrote: >From: "Janek Schleicher" > >> Am 24.10.2013 15:07, schrieb Shawn H Corey: my $email = Email::Simple->create( header => [ From => $sender_addr, To => 'ad...@

Re: Help needed with here documents (security?)

2013-10-24 Thread Octavian Rasnita
From: "Janek Schleicher" Am 24.10.2013 15:07, schrieb Shawn H Corey: my $email = Email::Simple->create( header => [ From => $sender_addr, To => 'ad...@tristatelogic.com', X-Server-Protocol => $server_protocol, X-Http-User-Agent => $ht

Re: Help needed with here documents (security?)

2013-10-24 Thread Janek Schleicher
Am 24.10.2013 15:07, schrieb Shawn H Corey: my $email = Email::Simple->create( header => [ From => $sender_addr, To => 'ad...@tristatelogic.com', X-Server-Protocol => $server_protocol, X-Http-User-Agent => $http_user_agent, X-Http-

Re: Help needed with here documents (security?)

2013-10-24 Thread Shawn H Corey
On Thu, 24 Oct 2013 06:30:58 -0700 Jim Gibson wrote: > > On Oct 24, 2013, at 6:07 AM, Shawn H Corey wrote: > > > On Thu, 24 Oct 2013 13:52:51 +0200 > > Janek Schleicher wrote: > > > >> use Email::Simple; > >> > >> my $email = Email::Simple->create( > >> header => [ > >> From

Re: Help needed with here documents (security?)

2013-10-24 Thread Jim Gibson
On Oct 24, 2013, at 6:07 AM, Shawn H Corey wrote: > On Thu, 24 Oct 2013 13:52:51 +0200 > Janek Schleicher wrote: > >> use Email::Simple; >> >> my $email = Email::Simple->create( >> header => [ >> From => $sender_addr, >> To => 'ad...@tristatelogic.com',

Re: Help needed with here documents (security?)

2013-10-24 Thread Shawn H Corey
On Thu, 24 Oct 2013 13:52:51 +0200 Janek Schleicher wrote: > use Email::Simple; > > my $email = Email::Simple->create( >header => [ > From => $sender_addr, > To => 'ad...@tristatelogic.com', > X-Server-Protocol => $server_protocol, > X-Http-

Re: Help needed with here documents (security?)

2013-10-24 Thread Janek Schleicher
Another way of handling is to use one of the availabe Email::* modules on CPAN. This would have the advantages of (beside you don't have to worry about details of string quoting): - better code, as you write down what you intend to do instead of how you do it - better security, as those module

Re: Help needed with here documents (security?)

2013-10-23 Thread Ronald F. Guilmette
In message <40504.1382576...@server1.tristatelogic.com>, I wrote: >>> Well, I added to the script some rudimentary filtering/validation of >>> the input strings in question also. >> >>you need more than rudimentary filtering. make sure the from field is >>one string, no newlines or anything but

Re: Help needed with here documents (security?)

2013-10-23 Thread Ronald F. Guilmette
In message <5268663c.4040...@stemsystems.com>, Uri Guttman wrote: >i think a blank line with . will end input to smtp servers. try that too >in the line after the from field. DING DING DING!!! Give that man a cupie doll, because he's the winner of today's perplexing puzzle test! In short, ye

Re: Help needed with here documents (security?)

2013-10-23 Thread Ronald F. Guilmette
In message <20131023193228.38cf83e2@sage>, you wrote: >On Wed, 23 Oct 2013 16:12:12 -0700 >"Ronald F. Guilmette" wrote: > >> I believe that you may be on to something here, but it is more than >> just Postfix seeing a \n\n and believeing that it had encountered the >> end of the headers. It is

Re: Help needed with here documents (security?)

2013-10-23 Thread Uri Guttman
On 10/23/2013 07:12 PM, Ronald F. Guilmette wrote: In message <52684f18.2000...@stemsystems.com>, you wrote: I _do_ know more than a little about mail servers, and while you are basically correct, i.e. that Postfix would certainly view anything past the first \n\n encountered as being *messag

Re: Help needed with here documents (security?)

2013-10-23 Thread Dr.Ruud
On 2013-10-24 01:12, Ronald F. Guilmette wrote: In message <52684f18.2000...@stemsystems.com>, you wrote: On 10/23/2013 06:18 PM, Ronald F. Guilmette wrote: ... print SM < From: "$sender_name" <$sender_addr> Subject: Your message to Tristatelogic.Com X-Server-Protocol: $server_protocol X-Http

Re: Help needed with here documents (security?)

2013-10-23 Thread Shawn H Corey
On Wed, 23 Oct 2013 16:12:12 -0700 "Ronald F. Guilmette" wrote: > I believe that you may be on to something here, but it is more than > just Postfix seeing a \n\n and believeing that it had encountered the > end of the headers. It is possible that something in the input > stream I gave it signal

Re: Help needed with here documents (security?)

2013-10-23 Thread Ronald F. Guilmette
In message <52684f18.2000...@stemsystems.com>, you wrote: >On 10/23/2013 06:18 PM, Ronald F. Guilmette wrote: > >> ... >> print SM <> To: "Tristatelogic.Com Administrator" >> From: "$sender_name" <$sender_addr> >> Subject: Your message to Tristatelogic.Com >> X-Server-Protocol: $server_protocol

Re: Help needed with here documents (security?)

2013-10-23 Thread Uri Guttman
On 10/23/2013 06:18 PM, Ronald F. Guilmette wrote: ... print SM < From: "$sender_name" <$sender_addr> Subject: Your message to Tristatelogic.Com X-Server-Protocol: $server_protocol X-Http-User-Agent: $http_user_agent X-Http-Referer: $http_referer X-Remote-Addr: $remote_addr X-Remote-Host: $remot

Re: Help needed with here documents (security?)

2013-10-23 Thread Ronald F. Guilmette
In message <39517.1382566...@server1.tristatelogic.com>, I wrote: >About a day ago, some schmuck set about to try, hard, to exploit the >personally written Perl code I have in place and that processes the >input for the contact form on my web site... I neglected to mention that this was obviousl