Wordpress mySQLinsertion vunribility in wp-mail.php

[Jaminadi]

Okay, this is a major concern for anyone with 'posting by email enabled' in Wordpress.
The warned you that giving out your address is a problem because other people can post to your blog. That isn't all there is.

In at least my current version of wordpress (1.5.2), the wp-mail.php page does not sanatize the input received and this leaves your database open the sqlInsertion. Because of the anyone can figure out how a wordpress data base is organized, hackers could add themselves, remove you, or perform any other data base function.

Also, this has the unfortunate side effect of preventing emails containing certain punctuation from being put into the data base(think quotations) and thuse never getting out of your pop3 box until you delete them.

If this hasn't already been addressed in more recent versions, it needs to be.

~Joshua
_________________
A woman is as a sword laid aside or a fire at a distance. THe one does not burn, the other does not cut those that approach not neigh unto them.

[Jaminadi]

I have fixed this vunrebility and the error in my home version. Here is how it was done.
The fix is actually quite simple.
Before sending the strings to the database, simply enclose them in a mysql_real_escape_string() php function. This will remove the possiblity of sql-insertion and other problems. I have already implemented it on mine, the changes are so minmal I have not created a diff or listed the code directly. (added the function on the outside right hand of the last $subject and $contend lines).
Does anyore else have the time or know how on how to fix the emerge to automaticly apply a patch. This is an update that should be included in the next release of wordpress, at least to gentoo users until they adopt the changes at the source.
Have a great day.
_________________
A woman is as a sword laid aside or a fire at a distance. THe one does not burn, the other does not cut those that approach not neigh unto them.