Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.If the recipient's e-mail address is in a hidden field, doesn't this essentially open up a way for spammers to send e-mail through your server? What's stopping them from setting up a bot to hit the "submit" button and sending out hundreds and thousands of e-mails through your server?
Comments
Comment #1
moshe weitzman commentedthere are some advaned techniques for hiding email adddresses. the most common by far is not to use any. changing to feature request..
Comment #2
broersma commentedHow about bots filling in the edit[to] field themselves? I believe that's what Steve meant.
Of course this is only a problem for form_mail-setups that allow specifying to To:-address as a hidden field in the form. But still, why give people the possibility to make their server into an open mail proxy?
Comment #3
gjost commentedOne of my Drupal sites was pumping out spam until i killed this module. "Allow custom recipient" was unchecked, so theoretically they should not have been able to set the email recipient, but somehow they did.
Unfortunately I need the basic functions of this module, so I've modified the code so that the email recipient can only be set to
variable_get("form_mail_email", "").We'll see if this works...
Comment #4
codepoet commentedWe were just hit by the same spammer. This module is broken and turns any site into an open relay.
Comment #5
moshe weitzman commentedi'd be pleased to hand over maintainership of this module to someone. i'm no longer interested in it.
Comment #6
dan_aka_jack commentedHi there,
I've had a shot at re-writing the module for Drupal 4.7 :
http://drupal.org/node/53543