formmail.cgi problem

[mr dobalino]

Hi,

I have taken over a site that has Matt's formmail script on it. It has been running fine for over a year but in the last week when someone goes to sign up for a newsletter, the browser doesn't execute the script, it downloads it.

In Firefox it shows the script in the browser and in IE it offers a download dialog box.

Any ideas why this is?

I have re-uploaded the script, changed and checked the permissions. I find it strange that it has only just started happening and had been working fine up until now.

Any advice would be great, thanks

[Yelgnidroc]

I'd check with your web host to start with. I assume you haven't changed hosts.

Is Matt's formmail secure now?

[mr dobalino]

yeh turns out it was a server side problem, should have got onto them sooner


cheers

[jimr451]

I'd check with your web host to start with. I assume you haven't changed hosts.

Is Matt's formmail secure now?

I wouldn't gloss over Yelgnidroc's last question here - the early formmail scripts had some security holes (I think related to passing user fields directly to a command line) - you probably should review your copy to make sure it's not vulnerable.

-Jim

[edatz]

I agree with jimr451. Many servers have outright banned Matt's script for security reasons. My datacenter uses nmsformail which is a more secure version and works pretty well.

[JavaServlet]

Matt's scripts were popular in the late 90's and now there are plenty of great server sides that provide efficient mail programs. Perl actually does have alot of good email modules. You can also look at CPAN modules for slicing and dicing email.

[perl_diver]

Perl has email modules but it does not have form to email modules. The emailing is the easy part, its avoiding the pitfalls of allowing strangers to use a form to send email that is the hard part. NMS formmail is a good script and the NMS Project also has an even better form to email script called TFMail.

[mr dobalino]

ok cheers, I appreciate the advice guys

[edatz]

You're welcome.

I didn't know about TFMail, p_d, will check that out. I use copies of nms formmail with different names for each client. Maybe TFM will make life a bit easier :)