Prevent harvesting of (un)disposable emailadresses

not_Dries_Buytaert - September 18, 2009 - 10:40
Project:Disposable e-mail protection
Version:6.x-1.0
Component:Code
Category:bug report
Priority:critical
Assigned:Unassigned
Status:active
Description

Paradoxically, this module prevents registration of disposable emailaddresses, but enables anyone to harvest and spam (un)disposable emailaddresses.

According to the official documentation (http://undisposable.org/docs.htm) the API allows checking against the online disposable hosts blacklist via following functions:
emailaddresses
http://www.undisposable.net/services/{$service_name}/isDisposableEmail/?email={$param_value}
hosts (domainnames)
http://www.undisposable.net/services/{$service_name}/isDisposableHost/?host={$param_value}
Whenever the function 'isDisposableEmail' is called, the module should isolate the host (domainname) from the emailaddress param_value and use that domainname to call the 'isDisposableHost'-function instead. This prevents emailadresses (mailbox names) from being sniffed, whenever the API is being used. NB: Currently, any (unauthorized) user can intercept (and thus harvest and spam) any untested emailadresses from the request addresses whenever a function other then 'isDisposableHost' is being used, as the API is NOT encrypted!

 
 

Drupal is a registered trademark of Dries Buytaert.