Gordon Messmer writes:
Jim Gifford wrote:
The only thing I have in my shell that uses variables is amavis. Here is
the amavis section
...
FROM=escape($SENDER)
...
TO=escape($RECIPIENT)
xfilter "/usr/sbin/amavis debug $SENDER $RECIPIENT"
/me snickers
So, you've gone to the trouble of escaping SENDER and RECIPEINT so that
you have shell-safe values in FROM and TO, but then use SENDER and
RECIPIENT on the command line? :)
xfilter "/usr/sbin/amavis debug $FROM $TO"
In all fairness, this was part of some (incorrect) instructions distributed
with a patch or something. I'm a little fuzzy in the brain today, so I
don't remember exactly where I got them from, but I ran into the same set of
instructions for amavis. I pointed it out to the author, at which point he
argued that he was right and I was wrong. So, I decided it wasn't worth the
battle.
So, take pity on those following instructions without fully understanding
what's going on...
I just think it's a real testament to the need to be careful which
instructions we follow, and the possible security implications of simple
mistakes.
Just my 2 cents worth,
David
10 messages in net.sourceforge.lists.courier-users[courier-users] Re: Wierd Error Message
