Subject: Re: FAQ? and a question

From: [email-masked] (Walt Dabell)
Date: Wed, 19 Oct 94 13:08:07 EDT

[email-masked] (Stephen R. van den Berg) said:
> David W. Tamkin <[email-masked]> wrote:
> >Walt Dabell asked:
> >| I would like to set up a .procmailrc file to look for a certian
> >| user, use the Subject: contents as a path/file.name and strip the
> >| header off. If the filename exists, it should be written over. 
> >| Is this possible?
> 
> >If there is a security risk that the subject will contain semicolons or
> >pipes, this might be better:

> This still leaves one security hole wide open: anyone can put "/../" in the
> pathname (thereby overwriting any of your files).

Security was not the question, or an issue in this case. I wanted
to give somebody the ability to upload (painlessly) a specific
set of file which they have responsibility for. I restrict the 
procmailrc script from accepting anything unless it's from them
and then all it does is deposit the file in a directory. I don't
see that as being much of a security issue. Although I guess it
could be in the wrong hands (but what isn't?).

Here's the script I ended up using. Thanks to David Tamkin for
the hints.

:0 
* ^From:.*thisuser
{
	#have to use sed to get rid of the leading space
	#of the Subject: field contents

	place=`formail -xSubject: | sed -e 's/ //'` 

	:0 ic
	#since procmail won't overwrite, check for file and delete
	#if it exists

	* ? test -f /tmp/somedir/"$place"
	| rm /tmp/somedir/"$place"

	:0bf
	# now write the body of the message out to a file

	| cat > /tmp/somedir/"$place"

}

Now it deposits the file in the right place and mails me the header
(so I know it's been changed). Just out of curiosity, how can I get it 
to throw away the header and mail me nothing?

Thanks again.

         Walt Dabell    (302)645-4225    [email-masked]  
       University of Delaware,  College of Marine Studies

---

From: [email-masked] (Bugs Bunny)
Date: Wed, 19 Oct 94 14:01:45 -0400

Walt Dabell ([email-masked]) writes on 19 October 1994 at 13:08:07 EDT
>[...]

Its trivial to spoof the "From:" header (see the one in this message).
Since files (potentially large ones) can be written in your directory,
you probably want a few more checks to ensure the message is from the
right person.  Or at least make it more difficult to spoof.

   Dan
====================== message is author's opinion only ======================
J. Daniel Smith         Bristol Technology Inc., Ridgefield, Connecticut (USA)
[email-masked]         (203) 438-6969, 438-5013 (FAX) {info,[email-masked]
                        FTP: ftp.bristol.com       WWW: http://www.bristol.com
                                --------
 Von guten Maechten wunderbar geboren, erwarten wir getrost, was kommen mag.
 Gott ist mit uns am Abend und am Morgen, und ganz gewiss an jedem neuen Tag.
	- Dietrich Bonhoeffer

---

From: [email-masked] (David W. Tamkin)
Date: Wed, 19 Oct 1994 13:24:13 -0500 (CDT)

| 
| Here's the script I ended up using. Thanks to David Tamkin for
| the hints.
| 
| :0 
| * ^From:.*thisuser
| {
| 	#have to use sed to get rid of the leading space
| 	#of the Subject: field contents
| 
| 	place=`formail -xSubject: | sed -e 's/ //'` 

If you have a newer formail with the -z option, you don't need the pipe
to sed: place=`formail -zxSubject:` will do it.

| 	:0 ic
| 	#since procmail won't overwrite, check for file and delete
| 	#if it exists
| 
| 	* ? test -f /tmp/somedir/"$place"
| 	| rm /tmp/somedir/"$place"

You can't put comments into the middle of a recipe like that.  Put them
between recipes, to the right of the flags, or (sometimes) to the right of
the action.  Also, when you have a pipe that doesn't really read in the text,
in addition to the 'i' flag, use 'h' so that procmail doesn't waste time
feeding the body.

| 	:0bf
| 	# now write the body of the message out to a file
| 
| 	| cat > /tmp/somedir/"$place"

Again, you can't put comment lines nor blank lines into the middle of a 
recipe (well, a pre-counted blank line is sometimes safe, being read as
an unconditional condition that always passes), and since the file is 
already rm'ed, you don't need to invoke cat; just name the file in /tmp
as a folder to save to and let procmail create it.  Either that or keep the
"| cat >" and drop the rm recipe above it.

| }

| Now it deposits the file in the right place and mails me the header
| (so I know it's been changed). Just out of curiosity, how can I get it 
| to throw away the header and mail me nothing?

Filtering the body through cat got rid of the body (since cat's output
was redirected and it wrote nothing to stdout).  That leaves the header
there to fall out of the braces and see the rest of your .procmailrc,
which probably saves the bodiless header in $DEFAULT.

Now, when you say you want it to mail you nothing, do you mean you want
it not to mail you anything or that you want it to mail you null?  It
seems to be mailing you null right now.  To keep it from mailing you
anything, just take the 'f' flag off the last recipe before the brace.

David W. Tamkin  P. O. Box 3284  Skokie IL  60076-6284
[email-masked]   MCI Mail: 426-1818   +1 312 714 5610