The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.I liked the forward module and used it on a site. Untill recently!!
I discovered that someone had been using it to send spam to huge lists of email addresses, referring to sites that promoted stuff that I wont mention and worse, giving the senders email an email address originating from my website / domain name! I had the module immediately disabled and activated a less feature rich module, email this page.
The only reason i discovered this was that in the admin section it told me that it had stopped the use of it one time because of suspicious activity (flood....etc).
Now the admin logs is showing continuing references to /forward/node-number showing either people trying to trace it or the spammer trying to find the link again.
What the forward module also didn't allow me to do was to restrict it to only members or certain roles.
So if anything changes in this direction, I will gladly use it again.
Comments
Comment #1
seanrWere you using the most recent version of it? If so, I need some help tracing that down. I eliminated a header injection vulnerability a couple of versions ago, so now I'm not sure how they were using it.
Also, I think I might look into adding captcha functionality to it.
Comment #2
seanrBTW, mine was based in part on the email this page module (and that one is quite a bit older), so it's likely that one suffers from the same vulnerability.
Comment #3
Eagle-i commentedWell, i think i got the latest version of forward; not sure though.
And i also figured that forward was somehow related to "email this page" as they looked alike and both did not allow for role restrictions (e.g. that unanomous users could not use it).
The reason for me using "email this page" right now is that it allows you only to insert a name and an email address (or more), no message. This is ok for now as it will refer to my site even if spammers would use it.
The forward module had this problem:
- anonomous users could access all it's features:
- put in lots of email addressess
- put in a message of whatever they choose.
Maybe it's a good idea to seperate these functions according to role:
- guests can only forward with the "email this page" capabilities
- members have full access to all features (accountability)
Thinking along.
Comment #4
seanrOK, I've beefed this up a bit and think I've nailed it. Please test it and let me know. Latest version is in CVS:
http://cvs.drupal.org/viewcvs/drupal/contributions/modules/forward/forwa...
Comment #5
(not verified) commented