REPLY: 2:240/8002@fidonet 5a68b741
MSGID: 1:320/219@fidonet 5fcc4486
CHRS: CP437 2
TZUTC: -0500
TID: MBSE-FIDO 1.0.7.20 (GNU/Linux-x86_64)
Hello Niels!

05 Dec 20 17:13, you wrote to me:

 NH> Hi Andrew,

 NH> One of my users has found and reported to me another issue with
 NH> regards to reading / listing private messages. While the fix in commit
 NH> [942e85] works for local, private echos, it does not take into account
 NH> the possibillity of two users having the same name (e.g. "Tom Smith")
 NH> but different AKAs. Since the fix in [942e85] does not check the From
 NH> / To addresses this may lead to the possibility of a user"Tom
 NH> Smith@1:2/3" reading and being able to list messages for "Tom
 NH> Smith@3:4/5".

This check should only be applied in NetMail areas.  EchoMail areas, by 
definition, do not specify a destination address, but only a to name.  There 
is no way, using standard FTN technology, to address an EchoMail message, even 
one flagged as private, to only Tom Smith@3:4/5 but not Tom Smith@1:2/3.  The 
message would be sent to all nodes connected to the echo, and any Tom Smith 
would be able to read them on any node in the echo.

 NH> I've already fixed the if (..) statments in mail.c (lines 1116, 1258
 NH> and 1909) and will provide a proper pull request in the next few days.
 NH> I just wanted to inform you that there is still a security issue and
 NH> that there is work being done to fix it.

I will certainly look at the pull request when you send it, and evaluate 
accordingly.

Andrew

--- GoldED+/LNX 1.1.5-b20180707
 * Origin: Phoenix BBS * phoenix.bnbbbs.net (1:320/219)
SEEN-BY: 1/19 123 16/0 18/200 90/1 103/705 105/81 120/340 123/130
SEEN-BY: 123/131 124/5016 154/10 203/0 124 221/0 1 226/30 227/114
SEEN-BY: 229/101 275 424 426 452 550 664 1016 230/0 240/5832 249/110
SEEN-BY: 249/206 317 400 261/38 280/464 5003 288/100 292/854 8125
SEEN-BY: 317/3 320/119 219 319 322/0 757 342/200 396/45 423/120 633/280
SEEN-BY: 712/848 770/1 2452/250
PATH: 320/219 203/0 280/464 229/101 426