On 2015-12-19 21:09, Brahmanathaswami wrote:
for closure on this

This works;

if tVisitorsInfo is empty then exit to top
        put getAddresses() into tAddresses
        put tVisitorsInfo into tBody
replace quote with backslash & quote in tContainer
        put ("echo " &  quote & tBody & quote & " | ") into tCmd
        put format ("mail -s \"Visitor Care Notice\" -r
\"no-re...@hindu.org\" " & tAddresses) after tCmd
        get shell(tCmd)


As I explained in a previous e-mail, please don't do this.

It allows anyone who can affect the contents of tVisitorsInfo to execute arbitrary code on your server.

It's much safer to put the body in single quotes to protect from shell expansion. Or put the body into a temporary file and pass it to "mail" using the "<" shell operator. Or use "open process" for "mail" and write the body content to the process's standard input. Or, well, pretty much anything else.

                                        Peter

--
Dr Peter Brett <peter.br...@livecode.com>
LiveCode Open Source Team

LiveCode on reddit! <https://reddit.com/r/livecode>

_______________________________________________
use-livecode mailing list
use-livecode@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription 
preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode

Reply via email to