Is it possible to integrate RT to an existing web form where clients can
select which issues they want to report besides using the e-mail? Here’s the
scenario:
Web form → client selects issue, describes problem, enters e-mail & other
contact information → client clicks submit report → server accepts
request, checks for required fields → sends e-mail to RT → RT responds to
client by sending back the trouble ticket
Is it possible to integrate RT to an existing web form where clients can
select which issues they want to report besides using the e-mail? Here’s the
scenario:
Web form → client selects issue, describes problem, enters e-mail & other
contact information → client clicks submit report → server accepts
request, checks for required fields → sends e-mail to RT → RT responds to
client by sending back the trouble ticket
Apologies for shouting but there is at least one anti-spam DNSBL devoted to
blacklisting sites running formmail.pl. I reviewed the formmail.pl code a few
years ago and found a number of very serious flaws; sadly, it hasn’t changed
since then. Basically formmail.pl turns your mailserver into an open relay
which is then trivially exploited by spammers. I’ve received spam via
formmail.pl scripts; this is not a theoretical problem.
Regardless of firewalling and other security measures you may have in place,
it’s a very bad idea to install known unsecure scripts like formmail.pl,
especially when there are plenty of secure alternatives available. You are
better off coding your own special-purpose web-to-mail CGI script, taking
care to hard-code or programmatically generate recipient addresses.
Please don’t take this as a personal attack. Formmail is a unfortunately very
popular and many people don’t know its lineage - they find out the hard way.
I bear a particular grudge against formmail because it’s so obviously broken,
it has been for a long time, and the author either doesn’t have the talent or
time to fix the code or the common sense to stop distributing it. IMHO,
Matt’s Script Archive gives a black eye to every responsible open-source
developer out there and I feel sorry for everyone who has installed formmail
in good faith, mistakenly believing that the author took reasonable security
precautions when designing the code.
Is it possible to integrate RT to an existing web form where clients can
select which issues they want to report besides using the e-mail? Here’s
the scenario:
Web form → client selects issue, describes problem, enters e-mail &
other contact information → client clicks submit report → server
accepts request, checks for required fields → sends e-mail to RT → RT
responds to client by sending back the trouble ticket
I would recommend that you avoid using the script mentioned below.
I took a look at the script and I didn’t see anything I knew how to exploit,
but I saw some things that make me suspicious:
Taint checking is not enabled. You should always enable taint checking
for CGIs.
The strict pragma is not used. Generally speaking, abiding by the
restrictions strict mode enforces, makes for better, more robust code.
Unless you are Damian Conway, use strict.
This script parses CGI arguments itself, instead of using CGI.pm. CGI.pm
is part of the standard distribution, and is well tested. Parsing CGI input
is not as trivial as it seems.
Warnings aren’t enabled. While running with warnings enabled does have a
slight speed impact, if you’re running this code, you’re not Yahoo!. If the
code can’t run without generating warnings, you should fix it.
If you want to know more about these issues, visit http://perlmonks.org/ and
search for ‘use strict’ ‘use CGI’.
Is it possible to integrate RT to an existing web form where clients can
select which issues they want to report besides using the e-mail? Here’s
the
scenario:
Web form → client selects issue, describes problem, enters e-mail & other
contact information → client clicks submit report → server accepts
request, checks for required fields → sends e-mail to RT → RT responds
to
client by sending back the trouble ticket
For those who don’t know, there’s also the NMS project which provides
drop-in replacements for Matt’s Script Archive scripts but without the
security problems. They have a formmail replacement available: