The 'return-path' header issue raised in Daigoro's tests is really puzzling me.

I have subsequently read (on several sites) that this header should be automatically created by the first receiving MTA which should perform some kind of check to see if the sender's domain is fully qualified. If it is not, the IP address is used in the header instead.

I also read a comment that MTA will by default use the username under which Apache is running, which would explain the 'apache @ xoops.org' in one of the examples. This made sense to me as it would indicate the 'real' location of the sender.

But then I read that this header can be sent with the email provided the mail is sent to the PHP mailer properly (something to do with a '-f' command?) That switch is actually visible in the example:

postmaster @ tegneserielogen.dk using -f

If this header can be customised it can therefore easily be forged. However it does indicate that it should be possible to tweak the email-related files in each module to modify the headers of emails passing through the XOOPS system?

I would like to find out because I don't want users having important notifications bounced or quarantined due to a receiving MTA/Spam filter somewhere demanding a full set of properly constructed headers.

Just found this post which is about the same issue. Looks complicated!

Quote:


I have no problem with it!!! Should I be happy??? or is it that I don´t notice it???

Quote:


I have no problem with it!!! Should I be happy??? or is it that I don´t notice it???

Gues it depends how the settings are set by each service provider....

best regards

Peekay et al.,

The problem observing isn't only with the 'return-path', although it's the easiest observable variable.

Alienhand opened a bug-report on SF, with the 'return-path' issue, and a fix has been made for that.
I opened another bug-report, where the 'return-path' issues was included but which included a more in-dept test of errors. This bug-report was cancelled as it was said to be a clone of the 'return-path' bug-report.

Here's an attempt at describing how the headers are build when an email is send from within xoops:

1. An empty email template is created.
2. Default, often wrong, header values are inserted.
3. XOOPS system assigns new values to many of the default header values (such as the return-path, and from variables).
4. The modules (or XOOPS system) assigns text to the template, and assigns even more values to the header. (Such as the message-body, who the message is to, etc.)
5. Finally the entire template is send to the mailer, to be converted into a real message and to be send to the world.

The 'return-path' error happened at point 3, and resulted in two return-paths being inserted. One correct and one empty.
And the empty one would trigger the insertion of a (often) wrong return-path by send-mail if the provider had set up php to start send-mail using -f. In many cases it would also make providers limit the amount of emails send to only a few every minute.

But many other header related errors happen between point 3 and 4.
I've not been able to test it, but I believe earlier versions of XOOPS did assign more variables per default (at point 3), making system and module designers not add enough variables (at point 4). And this is what now makes many modules and parts of the system break when trying to send emails.

I haven't had time to dig into the code, but now I'm supposed to have a week of vacation, so I hope to be able to get enough time to look at it.