Hi Andrew,
One of my users has found and reported to me another issue with
regards to reading / listing private messages. While the fix in commit [942e85] works for local, private echos, it does not take into account
the possibillity of two users having the same name (e.g. "Tom Smith")
but different AKAs. Since the fix in [942e85] does not check the From
/ To addresses this may lead to the possibility of a user"Tom
Smith@1:2/3" reading and being able to list messages for "Tom Smith@3:4/5".
I've already fixed the if (..) statments in mail.c (lines 1116, 1258
and 1909) and will provide a proper pull request in the next few days.
I just wanted to inform you that there is still a security issue and
that there is work being done to fix it.
This check should only be applied in NetMail areas. EchoMail areas, by definition, do not specify a destination address, but only a to name.
Sysop: | Eric Oulashin |
---|---|
Location: | Beaverton, Oregon, USA |
Users: | 103 |
Nodes: | 16 (0 / 16) |
Uptime: | 01:30:25 |
Calls: | 3,497 |
Calls today: | 3 |
Files: | 8,461 |
Messages: | 336,206 |
Posted today: | 5 |