Ticket #7245 (closed enhancement: fixed)
Keep certain interval to fetch mail message
| Reported by: |
|
Owned by: |
|
|---|---|---|---|
| Priority: | normal | Milestone: | 2.9 |
| Component: | Security | Version: | 2.0 |
| Severity: | minor | Keywords: | has-patch tested commit early |
| Cc: |
Description
wp-mail.php is exposed to run by third-party. If a malicious user loads wp-mail.php continuously, the sequential access to a mail server will occur. To protect these attack, wp-mail.php needs to be invoked with certain intervals.
I propose a constatnt WP_MAIL_INTERVAL to define interval minutes, and a option value mailserver_last_checked to keep the datetime when WordPress checked the mail server. You can stop using wp-mail.php if WP_MAIL_INTERVAL is set to zero (0).
Attachments
-
wpmail.patch
(717 bytes) -
added by lilyfan 4 years ago.
- Patch for wp-mail.php
-
7245.diff
(676 bytes) -
added by Denis-de-Bernardy 3 years ago.
Change History
-
attachment
wpmail.patch
added
- Keywords tested added
On a separate note, shouldn't we check that the mail servers aren't the default ones set by WP? It's like... poor example.com.
Plus, if whoever owns it actually sets up an account with the relevant details, he'll be posting on quite a bit of blogs. :D
- Keywords needs-patch added; has-patch tested removed
Where is mailserver_last_checked set? Regardless, it needs to use get_transient() and set_transient() rather than options.
comment:6
janeforshort — 3 years ago
- Milestone changed from 2.8 to Future Release
Punting to be evaluated in next development cycle due to time constraints.
- Keywords has-patch tested commit added; needs-patch removed
- Milestone changed from Future Release to 2.8
new patch allows to disable post by email by defining the new constant to false.
- Owner changed from anonymous to Denis-de-Bernardy
- Status changed from new to accepted
- Keywords early added
- Owner changed from Denis-de-Bernardy to westi
- Milestone changed from 2.8 to 2.9
Patch looks good.
Would like to reduce the churn in 2.8 this close to release.
Marking for early 2.9 + backport to 2.8.1
still applies clean
comment:11
westi — 3 years ago
Current patch is a little broken.
Tidying up and will commit.
comment:12
westi — 3 years ago
- Status changed from accepted to closed
- Resolution set to fixed
comment:13
follow-up:
↓ 14
aaroncampbell — 3 years ago
I think that set_transient's second argument is a time in seconds. I know you said 5 minutes, but you set it to 500 seconds which is 8.3 minutes. Not sure how much that matters, but I thought I'd point it out.
comment:14
in reply to:
↑ 13
westi — 3 years ago
Replying to aaroncampbell:
I think that set_transient's second argument is a time in seconds. I know you said 5 minutes, but you set it to 500 seconds which is 8.3 minutes. Not sure how much that matters, but I thought I'd point it out.
Oops. As you identified that was meant to be 300 not 500.. failed when I switched in the working value after testing with a really small number!
Patch for wp-mail.php