Eric d'Alibut writes:

No. That won't make any difference. From the maildropfilter man page:

Multiple text literals in a row are automatically concatenated, even if they use different quotes. For example:

FOOBAR="Foo"´bar´ SAVEDEFAULT=$DEFAULT import DEFAULT LOCALDEFAULT=$DEFAULT DEFAULT=$SAVEDEFAULT

This sets the variable FOOBAR to the text "Foobar".

In your example, you have three text strings in a row:

"reformail -I 'Subject: "

$MSGSUBJ

and

"'"

Which get concatenated together. Given the following subject line:

Subject: I 0wn U '; rm -rf $HOME #

After concatenation this becomes the following command:

reformail -I 'Subject: I 0wn U' ; rm -rf $HOME #'

xfilter executes $SHELL and passes the above command to execute, which wipes out your home directory.

In the long term, it's always better to read the maildropfilter man page thoroughly, and especially the part that discusses the difference between text literals that use single and double quoted strings; how that relates to variable expansion; how the environment of any subcommand inherit maildrop's variable; and related topics. You're probably not even aware that literal text string in maildrop recipes can use single quotes. The correct command is actually:

xfilter 'reformail -I "Subject: $MSGSUBJ"'

As maildropfilter man page explains, single-quoted strings are not expanded, therefore the following command gets executed by the shell:

reformail -I "Subject: $MSGSUBJ"

As the maildropfilter man page further explains, the shell inherits all maildrop variables as environment variables, so when the shell proceeds and parses the command, it will then properly do its own variable substitution.

------------------------------------------------------------------------------ Crystal Reports - New Free Runtime and 30 Day Trial Check out the new simplified licensing option that enables unlimited royalty-free distribution of the report engine for externally facing server and web deployment. http://p.sf.net/sfu/businessobjects