Re: MIME disable option? (hopefully not FAQ)

From: Daniel Stenberg <dast_at_sth.frontec.se_at_hypermail-project.org>
Date: Sun, 18 Apr 1999 13:51:16 +0200 (MET DST)
Message-ID: <Pine.GSO.4.10.9904181348230.13159-100000_at_metal.sth.frontec.se>

On Fri, 16 Apr 1999, Ron Brogden wrote:

> Basically, I most definitely do not want Hypermail to automagically decode
> and save MIME attachements into the archive directory.

There is no general switch-off for this, no.

> People should not be sending them to a list in the first place and I want
> to avoid any potential security issues this might lead to.

I am aware that the current way of storing attachments using the supplied name may offer ways to screw up the web server, such as your .htaccess example. However, instead of disabling the feature I would rather like to hear suggestions on how to avoid the risks.

> The docs offer an "HM_IGNORE_TYPES" variable but unfortunately this
> appears to have no "wild card" option.

The docs aren't really telling the truth here! ;) If you get a recent version, all the type-lists feature wildcard matchings.

--
             Daniel Stenberg - http://www.fts.frontec.se/~dast
   ech`echo xiun|tr nu oc|sed 'sx\([sx]\)\([xoi]\)xo un\2\1 is xg'`ol

Received on Mon 19 Apr 1999 03:48:30 PM GMT