| If you wish to only allow e-mail addresses
at the domain names in @referers to receive form results, you probably do not
need to change this variable. However, if you get any 'Error: Bad/No Recipient'
messages when running FormMail, you may have to revisit @recipients and make
sure you have correctly listed all domains or configured this variable.
@recipients is the most important variable you need to
configure. It is an array of regular expressions defining all valid recipients
that can be specified. In order for an e-mail to be sent to the recipient
defined in a form, the recipient e-mail address must match one of the elements
in the @recipients array.
SIMPLE SETUP:
For the most simple setup, place any domain name that you
wish to send form results to in the @referers array. Warning: This allows those
domains to also access your FormMail script and utilize it to process their own
forms, but likely this is what you intended anyway. If so, you can leave:
@recipients = &fill_recipients(@referers); NO, THAT IS NOT WHAT I INTENDED!
Another alternative, then, is to set @recipients equal to
the return value of the fill-recipients function and pass this function all of
the domains to which e-mail may be addressed:
@recipients = &fill_recipients('domain.com',
'sub.domain.com','another.com'); You are now allowing e-mail to any username (provided it
contains only A-Z, a-z, 0-9, _, - or .) at those three domains.
Similarly, since @recipients is just an array, you could
even do:
@recipients = (&fill_recipients('domain.com','sub.domain.com'),
'^otheruser1@otherhost\.com',
'^otheruser2@otherhost\.com'); This would allow any recipient at domain.com and
sub.domain.com similar to the previous example, but would also allow your
friends otheruser1 and otheruser2 on otherhost.com to use your FormMail! Of
course, you will need to add otherhost.com into your @referers array if a form
is on their host!
HOW DOES THAT WORK?
When the fill_recipients function is called on an array of
domain names, it turns them into regular expressions. These regular expressions
will only allow e-mail messages to go to a recipient with an e-mail address in
the following format:
[A-Za-z0-9_-\.]+@domain.com
where domain.com is specified in @referers. For any IP
addresses in @referers, the following address formats are valid:
[A-Za-z0-9_-\.]+@[192.168.1.1]
where 192.168.1.1 is the specified IP address in
@referers.
What this means in english is that the only valid addresses
are those to usernames that include only letters, numbers, underscores, dashes
or periods and an exact domain name or IP address that was specified in the
@referers array. Depending on your needs, this may be too broad or not broad
enough.
WHAT IF YOU NEED MORE FLEXIBILITY??
The way FormMail validates a recipient address is to check
the supplied recipient(s) in the submitted form against each element in the
array @recipients (which is a list of Perl regular expressions). If any valid
recipients are found, they will receive a copy of the message.
Using the examples of @referers =
('domain.com','192.168.1.1'); and the default usage of setting @recipients =
&fill_recipients(@referers), the contents of @recipients are now the same
as if you had written:
@recipients = ('^[\w\-\.]+\@domain\.com',
'^[\w\-\.]+\@\[192\.168\.1\.1\]'); What these regular expressions instruct FormMail to do
is require that any e-mail address passed in as a recipient of the form
submission match at least one of those two formats. The following are examples
of valid and invalid recipients for this exact setup:
VALID:
user@domain.com, First.Last@domain.com,
Last-First@domain.com, user_name@domain.com,
user023@domain.com, user@[192.168.1.1],
First.Last@[192.168.1.1], user023@[192.168.1.1],
Last-First@[192.168.1.1], user_name@[192.168.1.1], etc. INVALID: (using these in your form field 'recipient'
will trigger error)
user%name@domain.com, user(name)@domain.com,
first:last@domain.com ,
domain.com, user@192.168.1.1,
user@newdomain.com, user@sub.domain.com,
user@domainname.com Essentially, it only allows A-Z, a-z, 0-9, _, - and . in
the local address area (before the @, represented as [\w\-\.]+ in regular
expression speak) and requires the domain name to match exactly. When mailing
to an IP address, it must be enclosed in [].
BUT I NEED TO MATCH MORE CHARACTERS IN THE USERNAME!
Let's say you need to be able to deliver e-mail to an
address like: last:first@domain.com
This requires that the ':' character now be allowed into
the portion of the recipient field before the domain name. You could then
modify @recipients to read:
@recipients = ('^[\w\-\.\:]+\@domain\.com'); BUT BE CAREFUL!!!!
Allowing certain characters could be VERY dangerous,
especially if the characters are: %, <, >, (, ) or any newlines. You can
read:
http://web.nps.navy.mil/~miller/percent-hack.html
for information on exactly why the % character could be dangerous. And the
document that prompted 1.91 explains why some of the others could lead to
problems:
http://www.monkeys.com/anti-spam/formmail-advisory.pdf
I ONLY WANT CERTAIN ADDRESSES TO WORK!
Let's say you only want yourself@yourdomain.com to be able
to receive any form submissions. You should then set the @recipients array to:
@recipients = ('^yourself\@yourdomain\.com'); Now the only valid recipient is that one e-mail address.
If there are several, simply do:
@recipients = ('^user1\@yourdomain\.com',
'^user2\@their\.domain\.com'); CAN I USE SOMETHING EASIER?
Prior versions of FormMail recommended settings for
@recipients like:
@recipients = ('domain.com','192.168.1.1'); OR
@recipients = ('^joe@somewhereelse.com'); The first is bad because it can be easily tricked by
submitting a recipient such as spamvictim%elsewhere.com@domain.com. The second
is MUCH better, but since it is used as a regular expression, and '.' can mean
ANY character, a hacker could use joe@somewhereelseXcom to get past a valid
recipient check. This is not a very big deal in most cases.
WHAT IS THIS ^ CHARACTER AND WHY SO MANY \'s??
In regular expressions, the ^ means "beginning of string".
By default, FormMail places a $ at the end of the match, which means "end of
string". By using both ^ and $ in regular expression matching, FormMail can
match a string exactly. You only need to worry about including the ^, which is
STRONGLY recommended for all regular expressions in the array.
The \ character is used to escape a character that
otherwise means something special in regular expressions. For instance, you now
see every '.' being escaped with a '\', as '.' means ANY CHARACTER, whereas
'\.' requires that it match ONLY a period.
If you need a regular expression matching solution even
more specific than the above examples explain, I recommend picking up a book on
Perl. |