Closing a PHP Mail Form Vulnerability

I wrote a PHP script that accepts e-mail from web site visitors using a feedback form. The script works with different sites, routing mail to the right inbox with a hidden field on the form:

The who field doesn't specify an e-mail address, because that would be easy pickings for spammers. They crawl the web looking for e-mail scripts that can be configured to send e-mail to any recipient they specify.

Instead, my script was written to send mail only to accounts on my server:

$recipient = $_REQUEST['who'];

if ($recipient == "") {
$recipient = "rogers@ekzemplo.com";
} else {
$recipient = $recipient . "@ekzemplo.com";
}

Recently, a spammer found a way to make my script send e-mail to anyone on any server, generating hundreds of spams on my machine over a space of four days.

I'm curious to see if any programmers spot the giant honking vulnerability in the preceding code that I missed for months.

Programming · Php · Security · 2005/11/19 · 13 COMMENTS · Link

Jerry Lewis vs. Jerry's Kids

At an appearance in Chicago Wednesday night, Jerry Lewis flew into a rage when heckled off the stage by disability activists in wheelchairs, telling security to eject one overweight protester by commanding "move that living waterbed out of here."

The hecklers were from Jerry's Orphans, a group begun in the early '90s by Mike Ervin, a former Muscular Dystrophy Association poster child. They're angry about their portrayal in the Labor Day Telethon, as described in a documentary The Kids Are All Right:

Millions of viewers tune in every year and come away with the idea that people with disabilities need pity and charity rather than accessible public transportation and housing, employment opportunities and other civil rights that a democratic society should ensure for all its citizens.

In yearly telethons since 1966, Lewis has helped raise an estimated $2 billion in donations for "Jerry's Kids," a staggering figure that one might expect to shield him from criticism. But Ingrid Tischer, a woman with muscular dystrophy, describes how Lewis depicts people like her as wretched, helpless and hopeless, a portrayal that pulls in the money at the expense of their self-worth:

Minutes after I tuned in this year, a little girl was profiled in a video montage before she and her parents joined the host on stage. She sat listening quietly as her parents talked about how their little girl didn't have a future.

Unlike "normal" children, she was "confined" to a wheelchair and could be "struck down" at any moment. You couldn't see how these dramatic statements affected her because a "Call Now" graphic covered the lower portion of the screen -- right where her face was, and where the face of of any person who uses a wheelchair would be expected to be.

Here's the thing: Little girls who hear they don't have futures become women who don't have jobs. And people will never care that women with disabilities are excluded from their work places if they think of us as faceless bodies with special needs instead of women with equal rights.

In 1990, Lewis imagined himself having muscular dystrophy in a cover story he wrote for Parade Magazine:

I know the courage it takes to get on the court with other cripples and play wheelchair basketball, but I'm not as fortunate as they are, and I bet I'm in the majority. I'd like to play basketball like normal, healthy, vital, and energetic people. I really don't want the substitute. I just can't half-do anything -- either it's all the way, or forget it. That's a rough way to think in my position. When I sit back and think a little more rationally, I realize my life is half, so I must learn to do things halfway. I just have to learn to try to be good at being a half a person ... and get on with my life.

I may be a full human being in my heart and soul, yet I am still half a person, and I know I'll do well if I keep my priorities in order.

As an indicator of how volcanic the 79-year-old comedian became in Chicago, Lewis accused protesters of faking their condition, according to one person in attendance:

When he spotted these activists in the audience that were in the front row in their wheelchairs, he even went so far as to say 'These people are going to walk out of those chairs and drive home tonight. I bought those chairs for them.'

Update: Will Pfeifer has posted audio of the incident. Another attendee disagrees the characterization that he "flew into a rage."

Television · Politics · Movies · 2005/11/18 · 52 COMMENTS · Link

Strip Club Owner Gets Something Off His Chest

If you take the southbound State Road 207 exit on Interstate 95 near St. Augustine, Florida, you'll see Café Erotica, a decrepit rural strip club. The café, which reportedly shut down in September, has been engaged in a bitter fight with St. Johns County code enforcement supervisor James Acosta.

I know this not because I keep abreast of the club's activities, but because you can't miss the huge 10- by 40-foot sign it recently erected.

Whenever we drive past this sign, my kids laugh like Beavis and Butthead.

The county and Café Erotica have battled in court for years over signs that tell the world they "dare to bare." The club set up a web site, Dumb Butt Acosta, that describes the last sign they put up in his honor three years ago:

There is a political statement sign up saying "In our opinion, James Acosta is a fat ---Barney Fife type which has cost the county thousand of dollars in lawsuits for using selective enforcement." This sign was erected by Café Erotica. Apparently Barney Fife here has decided which operations are OK and which are not based solely on the name. ... Our original intention was simply a quick footnote on this jerk but we have decided that due to recent ranting from this gay acting, gun toting lunatic to be a little more generous in what we will release to the public about this -------.

The site reveals that the club's actual name is Café Erotica/We Dare to Bare/Adult Toys/Great Food/Exit 94, but it doesn't really dare to bare -- an extremely precise local ordinance requires opaque modesty:

Buttocks: The area at the rear of the human body (sometimes referred to as the glutaeus maximus) which lies between two imaginary straight lines running parallel to the ground when a person is standing, the first or top such line being 1/2 inch below the top of the vertical cleavage of the nates (i.e., the prominence formed by the muscles running from the back of the hip to the back of the leg) and the second or bottom such line being 1/2 inch above the lowest point of the curvature of the fleshy protuberance (sometimes referred to as the gluteal fold), and between two imaginary straight lines, one on each side of the body (the "outside line"), which outside lines are perpendicular to the ground and to the horizontal lines described above and which perpendicular outside lines pass through the outermost point(s) at which each nate meets the outer side of each leg. Notwithstanding the above, Buttocks shall not include the leg, the hamstring muscle below the gluteal fold, the tensor fasciae latae muscle or any of the above-described portion of the human body that is between either (i) the left inside perpendicular line and the left outside perpendicular line or (ii) the right inside perpendicular line and the right outside perpendicular line. For the purpose of the previous sentence the left inside perpendicular line shall be an imaginary straight line on the left side of the anus (i) that is perpendicular to the ground and to the horizontal lines described above and (ii) that is 1/3 of the distance from the anus to the left outside line, and the right inside perpendicular line shall be an imaginary straight line on the right side of the anus (i) that is perpendicular to the ground and to the horizontal lines described above and (ii) that is 1/3 of the distance from the anus to the right outside line.

The ordinance spends a lot less time defining breasts; someone in the county attorney's office must be an ass man.

I never visited the club. I'm too Catholic to enjoy it properly and even with "Great Food" in the name, I fear that sexually oriented businesses do not follow good hygienic practices in food preparation. A blogger visiting every Starbucks in the world made a stop in 2004 and was not impressed:

... the club was unremarkable, and not worth hanging out in, except to try out the weird-ass private dance room in which the customer reclined on a ... a recliner, I guess while the dancers straddled from above. Weird.

Jacksonville · Florida · 2005/11/16 · 20 COMMENTS · Link

My Due Diligence on the Liberal Ad Network

The Drudge Retort has been kicked out of the Liberal Blog Advertising Network, a group of 75 liberal sites organized by Markos Moulitsas of Daily Kos and Chris Bowers and Jerome Armstrong of MyDD under the guidance of BlogPAC, a political action committee that Moulitsas and Armstrong began in 2004.

Bowers personally invited me to join the network in May 2005, sending several e-mails until I agreed to become one of its founding members. I thought it was a good way to bring liberal blogs closer together and make some money in the 2006 election year, so I've been working on it for six months, running the network's "Advertise Liberally" ad on the Retort 6.5 million times during that span and setting up a private blog for members.

The network has been experiencing a double super-secret flamewar since Bowers announced in mid-October that they were unilaterally changing the rules in a way that excludes several well-trafficked members, including the Retort, Raw Story and Smirking Chimp.

At this time next year, I planned to be sunning on the deck of a new yacht bought with political ad riches, thanks to our country's lack of meaningful campaign finance reform. I saw myself picking up the New York Times, reading about the newly elected Democratic majority in both houses of Congress, the first day of Karl Rove's prison term and the Texas Rangers' victory in the World Series.

Instead, I've just given six months of effort and free ad space worth $2,200 to a liberal ad network that's now my competition.

Some conservatives will have a field day with this, suggesting that liberal bloggers don't know the business world because we're up in our ivory towers smoking medicinal marijuana as we search for gay spotted owls who want to get married. But things could be worse for the liberal ad network -- it could be Pajamas Media.

I think the moral of this story is simple: Practice due diligence before getting into business with Moulitsas, Armstrong and Bowers. A trait that makes them entertaining bloggers -- a talent for getting into fights they don't need to have -- doesn't translate well to making a network of weblogs advertiser friendly.

I realized this a few weeks ago when Moulitsas used the Daily Kos front page to threaten potential advertisers:

... campaigns should advertise on blogs to reach readers, not to "endorse" the publication. We're bloggers. We'll say things that are "controversial". If campaigns don't think they can weather such storms, then by all means they should NOT advertise on blogs.

Because every time a campaign freaks out at a blogger and pulls their ads, we're going to raise a stink about it and inevitably make that campaign look bad. So they should think long and hard before putting money into a Blogad campaign.

My jaw dropped when I read this response to the Kaine gubernatorial campaign in Virginia, which pulled an ad from Steve Gilliard because of his provocative depiction of an African-American politician in blackface. The political situation for a Democrat in a tight race, days before the election, was less important than a blogger's need to keep it real.

Moulitsas can afford to say crazy stuff, because Democratic politicians view Daily Kos as an ATM machine and assembly line for grass-roots liberal activists. He charges $1,400 a week for ads and regularly sells 6-8 of them.

For the rest of the 75-minus-me members in the liberal ad network, "don't pull an ad or we'll hurt you" is a bit of a tough sell.

Politics · 2005/11/15 · 123 COMMENTS · Link

Plain-Dealer Concocts Blog Scandal

The Cleveland Plain-Dealer did a hatchet job this week on potential Ohio Senate candidate Sherrod Brown and liberal blogger Nathan Newman.

On Tuesday, Plain-Dealer Washington bureau chief Stephen Koff reported that Brown plagiarized a weblog post written by Newman about Supreme Court nominee Samuel Alito's record on worker's rights issues.

Koff accurately describes how Brown's staff reused Newman's writing in a letter, but the 20-year reporter made a rookie mistake: He never asked Newman if he objected.

Newman doesn't object at all, and he informed the newspaper that his weblog entry was published on Daily Kos with permission for others to copy it: "Site content may be used for any purpose without explicit permission unless otherwise specified." An Associated Press story properly noted Newman's consent.

If Koff had spoken to Newman before the story ran, I have trouble believing it would have been published at all. No editor would want the story "Politician Omits Attribution on Letter; Original Source Doesn't Mind."

Instead of correcting its mistake, the Plain-Dealer has responded by attacking Newman in an unsigned editorial:

We need to know who is speaking. Is it a responsible, elected public official, or an Internet dilettante? Or is theirs a seamless relationship that makes a vote for Brown a vote for nathannewman.org or the Daily Kos?

Newman is an attorney and author with 20 years experience in public policy and postgraduate degrees from Berkeley and Yale. I'd love to find out which Plain-Dealer opinion writer wrote that sneer, so we can compare that journalist's background to a blogger dismissed as a dilettante.

Journalism · Politics · 2005/11/09 · 32 COMMENTS · Link

Cartoonist's Turn For the Worse

Gael Cooper regularly mocks the comic strip For Better or For Worse on Pop Culture Junk Mail, a great blog she's been publishing since 1999. Reading her latest entry reminded me of something I discovered recently: The creator of the strip, Lynn Johnston, shut down a longtime fan site in 2001 by threatening legal action:

We have our own very active website and are responsible for everything that is connected to For Better or For Worse. I support the initiatives taken by my syndicate to prohibit you from continuing your site. I hope we will not have to pursue this matter further.

The fan site, published by schoolteacher Rebecca Stephenson, made extremely limited use of Johnston's work, as you can see in the Alexa archive -- some people probably have more of her strips on their fridge. Stephenson wrote in the site's FAQ she was respecting copyright:

There is a strip on each of the character's pages which showcase them, but the reason I haven't put up any others is, first, because it is possible to find them elsewhere on the web (check the main page or the other FBoFW sites page for links) and second, because of copyright laws, I feel that I should only put enough actual FBoFW strips on this page to communicate the idea of what FBoFW is and who the characters are, and no more.

The site promoted Johnston's book collections and merchandise, noted the strip's copyright and declared its unofficial status. For three years before an official site was launched, it provided a place where fans could find out about the cartoonist and the characters. Her thank you for running the site, which was comfortably within the boundaries of fair use: Legal threats from the syndicate and Johnston.

With the pull she has at her syndicate, Johnston could have permitted the site under license or recognized that it wasn't an infringement. Instead, she bullied it offline to reduce the competition for her own site.

2005/11/08 · 4 COMMENTS · Link

Mark Evanier attended an onstage Jerry Lewis interview Thursday night, learning an odd bit of trivia about the comedian's socks:

Asked about the white sweatsocks that he usually wears, sometimes even with formal garb, he said, "I wear them because I like them. They feel comfortable to me. I change socks about four times a day, always putting on a brand new, never-before-worn pair. Each year, I send hundreds of pairs of socks to --" and he gave the name of some charitable organization in Las Vegas. "There are people in Hollywood who spend just as much money each year on something else that's white but they put it up their noses."

Movies · Television · 2005/11/05 · 1 COMMENT · Link

Read More Entries