mailhandler security bug

The mailhandler does not read user permissions correct anymore.

Because of some reason it onlly checks the user that uses the mailaddress were a message was sent from.

e.g. I have an email address, wich collects loads of newsletters, and places these in the queue. These are all collected from seperate addresses.

in options there is a pull-down providing the option to disable security. This is not taken into account when processing a mailed node.

line 103 of mailhandler.module
if (node_access("create", $node)) {

should be
if (node_access("create", $node) || $mailbox['security']==0) {

and maybe even
if (node_access("create", $node) || $mailbox['security']==0 || commands_defined_user_access($node)) {

commands_defined_user_access($node)) {
looks for a user&password in the commands and returns true if that user has accessrights.

Greets. Ber