0

I provide virtual hosting for a number of websites (mainly wordpress) maintained by others. Unfortunately one of them gets compromised and used to send spam (typically from a PHP script) from time-to-time.

I would like to be able to associate sites to emails sent so I can monitor mail volumes. This can be via an injected header or a log file or something similar.

PHP has an option "mail.add_x_header" which allows it to inject the name of the script being run to generate an email, but this appears to be an on/off option only, and only includes the relative path and filename being called.

Is there any way to extend PHP's functionality in a similar vain to include in the email header the name of the virtualhost or full path to the calling script, or otherwise provide some kind of log I can use to better control email sent through the server without having to make changes at the application level ?

2

Yes you can.

First: Set "auto_prepend_file" value in php.ini. For example auto_prepend_file=/usr/include/myownmailfunctions.php Don't forget to this file must be readable but don't writable.

Second: in this file you must change mail() function's name (runkit_function_rename) for this you must enable runkit extension. For example

//change mail func name to mail_original
runkit_function_rename("mail", "mail_original");
//define our mail function and users will use this after this time.
function mail() {
    //log here
    file_put_contents("/var/log/mail.log", json_encode(func_get_args()));
    // now call original mail function with parameters
    call_user_func("mail_original", func_get_args());
}

This is first way in my mind. Of course this isn't unbreakable solution but at least you can find spammers until people understand this trick.

  • Thats quite clever. Thank you. I didn't know about the auto_prepend_file directive, or, for that matter, runkit – davidgo Apr 11 '17 at 6:58
  • I hope this solves your problem. – kodmanyagha Apr 11 '17 at 7:24
  • I will look for better solutions. Becouse this is breakable by user. – kodmanyagha Apr 11 '17 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.