Phorummail for Phorum 5

I don't think that the mailserver user is www

---

Thomas Seifert

Quote
mmakaay
Also check if all path components are open. The script itself should be okay this way. But there could be a directory up the tree that is closed. Make those 755 as well.

Thank you Maurice. I double-checked just now, and all parent directories have 755 permissions. Any other ideas.

Quote
ts77
I don't think that the mailserver user is www

The mailserver user is not www; however, I don't think that matters when the file and parent directories have read and execute permissions for any user ("other").

Brandon Stout
[mscis.org]

Other idea: check if the first line of the phorummail script points to a working PHP cli program on your server. The download has got #!/usr/local/bin/php there, but on your system it might as well be #!/usr/bin/php instead. One thing to start with could be to become the mail user using "su" and then try to execute the phorummail script from the command prompt yourself. Maybe it spawns a useful error.

The user being www might or might not be a problem, based on what the mailserver thinks of it. I think you can configure sendmail to not open pipe commands if the owner of the script isn't the owner of the mail server process.

You might also be running sendmail with the smrsh prog mailer. That mailer will not execute any command, but only commands that are under or symlinked under /etc/smrsh.

---

Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce

Finally, I have a little more time to work on this again.

Quote
mmakaay
Other idea: check if the first line of the phorummail script points to a working PHP cli program on your server. The download has got #!/usr/local/bin/php there, but on your system it might as well be #!/usr/bin/php instead.

My php binary is /usr/local/bin/php, so the first line of the script is fine as it was.

Quote
mmakaay
One thing to start with could be to become the mail user using "su" and then try to execute the phorummail script from the command prompt yourself. Maybe it spawns a useful error.

You may be on to something here. I had a virt table entry to send mail addressed to the list to mscislist, but I had not created a mscislist user on the system. I created one just now, and gave user 'mscislist' shell access. Now I get the same mail log entries, and this new information in my non-deliverable email:

Quote

PHP Notice: Use of undefined constant phorum_page - assumed 'phorum_page' in /home/mscis/www/discussion/common.php on line 388
PHP Warning: require_once(PEAR.php): failed to open stream: No such file or directory in /usr/local/apache/phpinclude/Mail/mimeDecode.php on line 37
PHP Fatal error: require_once(): Failed opening required 'PEAR.php' (include_path='.:/usr/local/apache/phpinclude/') in /usr/local/apache/phpinclude/Mail/mimeDecode.php on line 37
554 5.3.0 unknown mailer error 255

Let's keep this in mind after we look into the above new errors.

Quote
mmakaay
The user being www might or might not be a problem, based on what the mailserver thinks of it. I think you can configure sendmail to not open pipe commands if the owner of the script isn't the owner of the mail server process.

You might also be running sendmail with the smrsh prog mailer. That mailer will not execute any command, but only commands that are under or symlinked under /etc/smrsh.

Brandon Stout
[mscis.org]

doh! seems like you don't have PEAR installed on the server.

---

Thomas Seifert

Quote
ts77
doh! seems like you don't have PEAR installed on the server.

That's what the error seems to indicate, but I have a pear cli that works. Perhaps I need to add the PEAR files to the include directive?

Brandon Stout
[mscis.org]

Quote
brasto
That's what the error seems to indicate, but I have a pear cli that works. Perhaps I need to add the PEAR files to the include directive?

Resolved. I had to:

* Create a user with the name that I used in the virt user table
* Give above user shell access
* Add :/usr/local/lib/php/ (directory where PEAR files go) to the include_path directive

Thank you all for your help and ideas!

Brandon Stout
[mscis.org]

OK, now the script is working, but it appears it will post to phorum even if the email address it came from is not in the users.password field - so anyone can post by email. Is there an existing function I can use to make this impossible, or do I need to manually add code that connect to the phorum db and only continues if the email address it came from exists in the users table?

Has anyone written code that only allows valid users (via the from field email address) can post by email?

Brandon Stout
[mscis.org]

After this code:

if(PMAIL_USE_EMAIL_FOR_LOGIN){
    $new_message["user_id"]=phorum_user_check_field( "email", $new_message["email"] );
    $user=phorum_user_get($new_message["user_id"], false);
    $new_message["author"]=$user["username"];
    $new_message["email"]="";
}

I added this:

if($user["username"] == ""){
 exit();
}

It appears to work. Any feedback? Might this cause problems?

Brandon Stout
[mscis.org]

I don't think it will cause problems. This will exit with exit code zero, which flags the mail server that the delivery was successful. This will silently ignore the message. For debugging, it might be better to implement a fault system though, where you flag the mailserver that a delivery failed. That way, the mailserver can create a bounce message which tells the original sender that the mail did not reach the forum. It might be enough to use a die() statement there. Something like:

if ($user["username"] == "") {
    die("Mail delivery failed, because no username was found in your mail.");
}

---

Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce