Limit number of recipients per forward

Hi There,

first of all, thank you very much for this wonderful module.

But I see the same problem:
While it is possible to limit how many times the form can be submitted by a user in one hour through admin settings, there seems to be no limit how many recipients are submitted through the form. It would be a big problem if someone pastes a list of hundreds or more adresse into the form or sends this as a POST request to the server. The way of manually pasting many adresses also opens the possibility to make the captcha for this form useless.
It really would be more secure to have the possibility to set a value for a number of maximal recipients for one form submission. Maybe there's a way to at least hardcode a value of maximal recipients in file "forward.module" (using version 5.x-1.11) line 539

foreach ($recipients as $to) {
    drupal_mail('forward', $to, $subject, $body, $from, $headers);
  }

I have changed this to the following:

  if ((count($recipients) <= 7) == TRUE) {
    foreach ($recipients as $to) {
      drupal_mail('forward', $to, $subject, $body, $from, $headers);
    }
    if ($nid == '') {
      $nid = 0;
    }

    // insert record into db to record nid, type and timestamp of send
    db_query("INSERT INTO {forward_log} (nid, type, timestamp) VALUES ('%d', '%s', %d)", $nid, 'SENT', time());
    // update node forward statistics
    db_query("UPDATE {forward_statistics} SET forward_count = forward_count+1, last_forward_timestamp = %d WHERE nid = %d", time(), $nid);
  
    variable_set('forward_total', variable_get('forward_total', 0) +1);
    variable_set('forward_recipients', variable_get('forward_recipients', 0) + count($recipients));

    flood_register_event('forward');

    drupal_set_message(variable_get('forward_thankyou', t('Thank you for your help in spreading the word about') .' '. variable_get('site_name', 'drupal') .'. '. t('We appreciate your help.')), 'status');
    return $returnurl;

  }
  else {
    form_set_error('recipients', t('Sorry, too many recipients. Allowed are maximal five addresses'));
  }
}

This will return an error message if there are more than 7 recipients in the "Send to" textfield. I have used the number 5 to inform the end user about that and to have a small reserve, if someone good just tries to spread the word about your site to some of his friends. but this should block spammers from sending too much email from this form. I also recommend using a captcha for this form, if you plan to let anonymous visitors use it.

To inform users about the limit, I have also changed line 342 in file "forward.module" from

    '#description' => t('Enter multiple addresses on separate lines or separate them with commas.'),

to:

    '#description' => t('Enter multiple addresses on separate lines or separate them with commas. Allowed are maximal five addresses.'),

I appreciate any comments, testing, improving on this. It's my first idea on this problem.

Hope this helps someone ...

Best Regards

Hannes

Hannes,

This is a very valuable contribution. The lack of limiting the number of recipients has prevented me from applying this module so far!

Juerg

I can confirm that your modification is working well. I suppose you provide a patch so that your mods can be committed.

Going to get this in the next release (will update here when it's done). Thanks.

subscribing

I had a client today inform me that because the Forward module does not limit the number of recipients, spammers had been sending up to 3,000 emails out for certain nodes. This caused havoc with their email servers, hosting company, etc., and they demanded a fix.

Attached is a simple patch that adds a Maximum Recipients setting to the Forward settings page, and then limits the number of recipients on the form itself. This way, between flood control and max recipients, we can deter people from sending too many needless emails, while allowing site admins to configure their email threshold.

I've upped the priority to critical as I think this is a huge risk, as it basically allows anyone to use this module to spam as many people as they want, regardless of the current flood settings.

My apologies, apparently during an upgrade, somehow the "override flood control" setting was enabled for Anonymous users, which caused the gaping security hole. The module correctly halts mass mailing according to the flood setting when this permission is removed. Sorry about the mixup!

Yes, grant that permission VERY sparingly. ;-)

I cannot seem to find this patch in either 6.19 or the latest dev-build. Sam Lerner's patch looks good, though I haven't tried it. I rolled my own patch, which is simpler, and which I include.

Am I correct in assuming that this line from forward.module:

if (!flood_is_allowed('forward', variable_get('forward_flood_control', 10) - count($recipient_addresses) + 1)) {

counts every message for every recipient as 1 message? This could be confusing to end-users who may not realize that sending 1 message to 7 different users counts as 7 distinct messages. In that case it might be useful to at least change the help text for the recipients field.

(That change though is not what I included in my patch, as it wasn't relevant; my customer simply wanted to cap the number of recipients at 5.)

I don't see where I have the control for how many mails people can send out after 5 years of this post. Can any one tell me where can I set this up in the latest 7.x-3.x version ? Thanks