Paul Oehler wrote:
Is this something related to how qmailadmin (which I know the least about re: vpopmail) does authentication?
There is a function that provides authentication:
vpasswd( user, domain, password, is_apop )
that returns the user's password info if valid, or 0.
The problem is, if you can execute the vpopmail library at all, you can execute every function within it. This is how QmailAdmin checks to see what you are allowed to do when you login.
Rick
