[fxs158]

Originally Posted by Cyricx

Like so

// this grabs an overview of all the messages in the mailbox and creates an array we can read
  $letters = imap_fetch_overview($mailbox,"1:$amountmessages",0);
 
//then later in the cron file it checks the array we made above and determines the sender and host to determine the email address.
   $fromaddress = $letter->sender[0]->mailbox ."@".$letter->sender[0]->host;
 
// then later it does this query to find a user that has that email address
   $userinfo = $vbulletin->db->query_first("
    SELECT user.*, usertextfield.*
    FROM " . TABLE_PREFIX . "user AS user
    LEFT JOIN " . TABLE_PREFIX . "usertextfield AS usertextfield ON (usertextfield.userid = user.userid)
    WHERE email = '".addslashes(htmlspecialchars($fromaddress))."'
   ");
 
// finally in the cron file it does this which is where if there is not a user found in the above query, it sends the person an error message.
 
   // If Email Address belongs to a user
   if (!$userid)
   {
    $userinfo['username'] = "Unregistered User";
      $userinfo['languageid'] = 0;
    eval(fetch_email_phrases('ei_error_nouser', $userinfo['languageid']));
    vbmail($fromaddress, $subject, $message);
    imap_delete($mailbox,$msgno);
    continue;
   }

You guys are killin me here

I think I've mentioned this a few times in this thread how it determines the user that is posting

Thanks for the info, I am no coder but if i am understanding correctly this is checking that the email comes from the correct address and or domain and then cross reference the email with one of my database.

I am still not understanding how the script would prevent someone with an email address on same domain and a fake header, from posting as someone else.

I would think that a better approach would be to issue a unique hash to each user on the forum and when the email is sent to them this hash must be somewhere in the email so that when users reply the software will authenthicate the user. Or something along the lines.


Great job by the way on the scrip, I have not been this excited about a hack in a long time!!!!!