I already remove $FROM in calling amavis.
Do you mean *after* you posted your maildroprc to the list?
This is not problem becouse virus report is send directly from amavis to me ( postmaster@ ).
The virus report has nothing to do with your problem. Your problem was that you got an email with an & in the address, and then constructed and ran a command like this:
/usr/sbin/amavis sender&[EMAIL PROTECTED] local
As a result, the shell tried to execute:
/usr/sbin/amavis sender # in the background [EMAIL PROTECTED] local
Now lets say that someone send you an email with the address hi&sh&[EMAIL PROTECTED] You'd execute these commands with the message body on stdin.
/usr/sbin/amavis hi sh [EMAIL PROTECTED]
I haven't checked to see what the results of that are, but since amavis won't read stdin becuse its command line is incomplete, and "[EMAIL PROTECTED]" isn't going to be a valid command, "sh" is probably going to read the message body from stdin and attempt to execute every single line.
ALWAYS escape user supplied data before using it in a shell. (and avoid passing user supplied data to a shell whenever you can)
But I can't locate in docs this 'escape()'. It is not documented or I miss something?
You're missing something. It's in the maildropfilter man page.
------------------------------------------------------- This SF.net email is sponsored by OSDN's Audience Survey. Help shape OSDN's sites and tell us what you think. Take this five minute survey and you could win a $250 Gift Certificate. http://www.wrgsurveys.com/2003/osdntech03.php?site=8 _______________________________________________ courier-users mailing list [EMAIL PROTECTED] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
