Navaho Gunleg

I was just setting up the post-by-email functionality in WordPress (1.5), which pops a POP3 server for new messages, and posts them in a pre-configured category.

All fine and dandy — although the output of that script is showing the email-address of the original poster.

The fact that this script is publicly available (it is in the same directory as the other WordPress scripts) scares me. So because I’m lazy and haven’t moved the file, but simply changed its permissions, it cannot by read the webserver serving up the files, so it will not be executed.

But, the output of that page, and the amount of people that use the software, made me realize other people didn’t think of this little fact. So, just out of curiousity I tried to do a search in Google for URIs containing ‘wp-mail.php’ and one of the progress messages that the script displays.

Holy cow! Plenty hits there. I bet most of those people get plenty spam as well, because I can’t be the first one discovering this.

Some people did at least remove the email-address from the messages, so a thumbs-up there.

So — if you are reading this, and you use WordPress, you might want to change the set-up. Now that PHP has a command-line interface, the script can be run from the crontab as ’someuser’, and if you change the ownership of the ‘wp-mail.php’ file to ’someuser’ and make it unreadable for others, the webserver will ignore it. And the messages you email will still be posted.

WordPress