MailScanner has detected a possible fraud attempt from ".."

MailScanner has detected a possible fraud attempt from ".."

by Zbigniew Fiedorowicz -
Number of replies: 3
Moodle currently emails forum posts containing glossary autolinks in the form that they appear within the forum module. This results in dysfunctional autolinks in the email of the form <a href="../glossary/...

While previously I didn't care too much about this, there is now an unfortunate interaction with a mail spam detection software running on Ohio State mail servers called "Mail Scanner". Recently some heuristics have been added to Mail Scanner for detecting and warning about phishing attempts in the email. This code in Mail Scanner now flags the dysfunctional autolinks in the Moodle email as cloaked urls designed to redirect unsuspecting Outlook (Express) users to evil phishing sites, and adds the warning in the subject line to every autolinked term in the email. Consequently a lot of my moodle.org email has become unreadable.

Our mail server administrators are unsympathetic to requests to modify the Mail Scanner configuration. They point out with some justification that the problem lies with Moodle.

It should be fairly easy to modify the forum email code to do a search for glossary autolinks in the outgoing email and replace the dysfunctional urls ../glossary/... by something like
$CFG->wwwroot . "/mod/glossary/..."

My concern is that perhaps these autolinks might appear elsewhere in Moodle email besides forum post emails and perhaps the fix should go elsewhere.

I have filed a bug report on this.
Average of ratings: -
In reply to Zbigniew Fiedorowicz

Re: MailScanner has detected a possible fraud attempt from ".."

by Zbigniew Fiedorowicz -
Here's a screenshot of an email from moodle.org as it appears in my mailbox.

Attachment screenshot.gif
In reply to Zbigniew Fiedorowicz

Re: MailScanner has detected a possible fraud attempt from ".."

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Something very strange is going on.  Those dots shouldn't be in there.  I've posted replies in bug 2953.