Formmail

[taj79]

I want to make a form in my website:
http://www.bestfromindia.com/link.html

I went to this website after someone referred to me:
http://www.scriptarchive.com/formmail.html

I followed their instruction and made necesary changes in formmail.pl and put this file in cgi-bin directory.
My General Server Information
PERL version: 5.006001
PERL Path: /usr/bin/perl
Sendmail Path: /usr/sbin/sendmail


I am having problems.Please help me out .I have emaild to Matt but didn't got any reply.If u know of any better way to make forms please do tell me:

Below is the modified formmail.pl


#!/usr/bin/perl
##############################################################################
# FormMail Version 1.92 #
# Copyright 1995-2002 Matt Wright mattw@scriptarchive.com #
# Created 06/09/95 Last Modified 04/21/02 #
# Matt's Script Archive, Inc.: http://www.scriptarchive.com/ #
##############################################################################
# COPYRIGHT NOTICE #
# Copyright 1995-2002 Matthew M. Wright All Rights Reserved. #
# #
# FormMail may be used and modified free of charge by anyone so long as this #
# copyright notice and the comments above remain intact. By using this #
# code you agree to indemnify Matthew M. Wright from any liability that #
# might arise from its use. #
# #
# Selling the code for this program without prior written consent is #
# expressly forbidden. In other words, please ask first before you try and #
# make money off of my program. #
# #
# Obtain permission before redistributing this software over the Internet or #
# in any other medium. In all cases copyright and header must remain intact. #
##############################################################################
# ACCESS CONTROL FIX: Peter D. Thompson Yezek #
# http://www.securityfocus.com/archive/1/62033 #
##############################################################################
# Define Variables #
# Detailed Information Found In README File. #

# $mailprog defines the location of your sendmail program on your unix #
# system. The flags -i and -t should be passed to sendmail in order to #
# have it ignore single dots on a line and to read message for recipients #

$mailprog = '/usr/sbin/sendmail -i -t';

# @referers allows forms to be located only on servers which are defined #
# in this field. This security fix from the last version which allowed #
# anyone on any server to use your FormMail script on their web site. #

@referers = ('bestfromindia.com','209.51.158.90');

# @recipients defines the e-mail addresses or domain names that e-mail can #
# be sent to. This must be filled in correctly to prevent SPAM and allow #
# valid addresses to receive e-mail. Read the documentation to find out how #
# this variable works!!! It is EXTREMELY IMPORTANT. #
@recipients = &fill_recipients('@referers');

# ACCESS CONTROL FIX: Peter D. Thompson Yezek #
# @valid_ENV allows the sysadmin to define what environment variables can #
# be reported via the env_report directive. This was implemented to fix #
# the problem reported at http://www.securityfocus.com/bid/1187 #

@valid_ENV = ('REMOTE_HOST','REMOTE_ADDR','REMOTE_USER','HTTP_USER_AGENT');

# Done #

-------------------------------------------
I have not put the rest of the formmail.pl as that part need not be modified.

[pyro]

For this script, and your other one, did you remember to upload in ASCII, and to CHMOD the files to whatever the READMEs specified? If not, that is probably where you problems are coming from.

[taj79]

I used Upload file(s) option in my server.
I suppose that take cares of evrything.
For ASCII mode and Binary mode uploading is there with FTP.
I think Upload file(s) option take cares of everything.

[pyro]

Originally posted by taj79
I used Upload file(s) option in my server.
I suppose that take cares of evrything.
For ASCII mode and Binary mode uploading is there with FTP.
I think Upload file(s) option take cares of everything.

Perhaps it takes care of the uploading in ASCII/Binary, but I wouldn't trust it. If you have the choise, use ASCII. As far as the CHMOD, your server won't take care of that as you upload. You will have to do it manually. That is almost certainly your problem.

[jeffmott]

taj79
I went to this website after someone referred to me:
http://www.scriptarchive.com/formmail.html

Whoever referred you, stop listening to them. Although the majority of scripts available are buggy and insecure, Matt's Script Archive is among the worst.

Security Focus put MSA FormMail attacks third in their list of the Top Attacks for the 1st Quarter of 2002.

[taj79]

Please tell me in detail how to do that........
Till now I have been using Upload File(s) option only.......

[pyro]

Well, it really depends on what you are using to upload your files. I gather from your previous post that you probably use a web based upload form? If so, I'm not positive how you'd go about changing the permissions (CHMOD). But if you use a FTP program, it shouldn't be difficult. I'll explain how to do it in WS_FTP (I think you can probably get a free demo version). Browse to you file (it should be in your cgi-bin) and click on it. Then right click and choose CHMOD (UNIX). Now you will need to enter 755 (for this formmail script, it's different for others). This will set the permissions for you script.

[taj79]

I have chenged the file permissions to 755.
What next should I do?

[pyro]

Provide a link to the page you have this set up on, and let me know what if any error messages you are receiving. It's hard to debug a CGI/Perl script if you can see what's going on.

[taj79]

I want to make a form in my website:
http://www.bestfromindia.com/link.html

Is my server's IP address 209.51.158.90?

[pyro]

First of all, I would change this line:

<form ACTION="/cgi-bin/formmail.pl" METHOD="POST">

to this

<form action="http://www.bestfromindia.com/cgi-bin/formmail.pl" method="post">

Not sure if it matters, but that is still how I would do it.

Internal Server Errors are about the most annoying things...Impossible to check what is wrong.

The first thing for you to do is to make sure you uploaded in ascii format. Try re-uploading the script in ascii and check if it works. Let me know...

[taj79]

I changed it ......... but don't know how to upload in ascii mode
I used Upload File(s) option.

[pyro]

CGI and Perl script need to be uploaded in ascii mode to work. You may want to try downloading the trial version of WS_FTP and using that. A FTP program would be good to have anyway, if you are going to be managing a site...

http://www.ipswitch.com/Products/file-transfer.html

[taj79]

I m trying to connect to the HOST name ftp.bestfromindia.com
with my user ID and passwd.
But WS_FTP is giving connection failure.
I m also not able to connect to ftp.ftpplanet.com
What should I do?

[pyro]

Try this

Host Name: bestfromindia.com
UserID: yourusername
Password: yourpassword

That should work. If it doesn't, you may have to contact your host...With me not being able to try things for myself, it's very hard to know what's wrong.

By the way...What hosting company do you use?