Hi again,
Euro 2008 is over, so I finally get to do useful things again ;>
The mentioned changes should be incorporated now. Functionality stays
the same, so my comments on the bugs remain the same, too.
Cheers, Daniel
Index: spamd/spamd.raw
===================================================================
--- spamd/spamd.raw (revision 672847)
+++ spamd/spamd.raw (working copy)
@@ -2084,6 +2084,17 @@
if ($prefsfrom eq $suidto) {
$userdir = $suiddir; # reuse the already-looked-up info
+ } elsif ( $opt{'vpopmail'} ) {
+ #
+ # If vpopmail config enabled then set $userdir to virtual homedir
+ #
+ no re 'taint';
+ my $username = ( $username =~ /^([-:,[EMAIL PROTECTED])$/ ? $1 : undef );
+ my $vpopdir = $suiddir; # This should work with common vpopmail setups
+ $userdir = `$vpopdir/bin/vuserinfo -d \Q$username\E`;
+ if ($? != 0) {
+ $userdir = handle_user_vpopmail($username,$vpopdir);
+ }
} else {
$userdir = (getpwnam($prefsfrom))[7];
}
@@ -2105,28 +2116,42 @@
handle_user_set_user_prefs($userdir, $username);
}
+sub handle_user_vpopmail {
+ #
+ # If vuserinfo failed $username could be an alias
+ # As the alias could be an alias itself we'll try to resolve it recursively
+ # Because we're mistrusting vpopmail we'll set off an alarm
+ #
+ my $username = shift;
+ my $vpopdir = shift;
+ my $userdir;
+ my $vpoptimeout = 5;
+ my $vptimer = Mail::SpamAssassin::Timeout->new({ secs => $vpoptimeout });
+
+ $vptimer->run(sub {
+ my $vpopusername = $username;
+ local $SIG{ALRM} = sub { die "failed to resolve vpopmail user/alias '$username' in time ($vpoptimeout seconds)" };
+ do {
+ $vpopusername = `$vpopdir/bin/valias \Q$vpopusername\E`;
+ $vpopusername =~ s/.+ -> &?(.+)/$1/
+ or die "failed to resolve vpopmail user/alias '$username' using vuserinfo/valias";
+ untaint_var(\$vpopusername);
+ } until (($userdir = `$vpopdir/bin/vuserinfo -d \Q$vpopusername\E`) && $? == 0);
+ alarm 0;
+ $userdir =~ s,.+ -> (/.+)/Maildir/,$1,;
+ });
+
+ if ($vptimer->timed_out()) {
+ undef $userdir;
+ } else {
+ chomp($userdir);
+ }
+ return $userdir;
+}
+
sub handle_user_set_user_prefs {
my ($dir, $username) = @_;
- # If vpopmail config enabled then set $dir to virtual homedir
- #
- if ( $opt{'vpopmail'} ) {
- my $vpopdir = $dir;
- $dir = `$vpopdir/bin/vuserinfo -d \Q$username\E`;
- if ($? != 0) {
- #
- # If vuserinfo failed $username could be an alias
- #
- $dir = `$vpopdir/bin/valias \Q$username\E`;
- if ($? == 0 && $dir !~ /.+ -> &/) {
- $dir =~ s,.+ -> (/.+)/Maildir/,$1,;
- } else {
- undef($dir);
- }
- }
- chomp($dir);
- }
-
# don't do this if we weren't passed a directory
if ($dir) {
my $cf_file = $dir . "/.spamassassin/user_prefs";
