src/sbbs3 qwktomsg.cpp 1.59 1.60
Update of /cvsroot/sbbs/src/sbbs3
In directory cvs:/tmp/cvs-serv16663
Modified Files:
qwktomsg.cpp
Log Message:
Address 2 QWK/REP-importing security issues:
1. If QWKE was enabled for the QWKnet account on the Hub, a user could spoof
their name with a "From:" QWKE kludge line in the message body. Fixed by
not processing QWKE "From:" kludge lines at all, ever.
2. If an @VIA kludge line was in the message body, it could over-ride the
correct value from the HEADERS.DAT (oops). Really, the SENDERNET* lines
in the HEADERS.DAT were always being overriden by either the @VIA kludge
line (if present) or just the auto-genereated SENDERNET info (from the
QWK-ID of the QWKnet account or hub. Normally, in a single hop QWKnet
message, there will be no @VIA line, so spoofing is still possible in that
case.
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ
telnet://vert.synchro.net