How to prevent from cheating when user puts somebody else’s Internet address in Location and sends e-mail throught Internet ? Then, you cannot check by who was it sent actually …
Subject: Cheating with Internet address in Location
Kat,
There is no way for a user to fake their “from” e-mail address when sending e-mail in the Notes client.
If you are instead talking about your own custom Domino web application where you are providing a feedback form and asking user to provide his or her e-mail address, you can’t prevent that person from entering someone else’s e-mail address.
As for someone having the ability to change an e-mail address appearing in the location bar of the web browser, the simple solution is not to pass it in the URL. Use the default POST method, not GET.
Ken
Subject: RE: Cheating with Internet address in Location
If you are using a custom web form that is used anonymously, there’s no way you can confirm whose actually filling in the form. However, if you require the users who fill the form in to authenticate, that means they have a person document somewhere. After they’ve authenticated, you can use the session property EffectiveUserName (notesSession.EffectiveUserName) to test which user is currently using the page. Once you capture this, it’s easy to get the e-mail address of that user and compare it to the one they’ve entered … you could even have the e-mail field computed by your script.
Subject: RE: Cheating with Internet address in Location
I think you are both missing her scenario. She is not talking about a web application, she s talking about sending out smtp mail from the Notes client, and I do believe the Internet address can be faked here if they are smart enough.
Subject: The ReplyTo can, but the headers will contain the Actual user that sent the mail.
Subject: Strip inetfrom and principal field from outgoing internet mail
In the configuration document, on the MIME - Advanced - Advanced outbound messaging tab, you can specify Notes fields that should be removed from outgoing internet mail. You should strip off the InetFrom field, wich holds the internet address as specified in the location document, and the principal field. When those fields are missing, the router will do a lookup in the Domino Directory to find the senders’ correct internet address. If the person doc doesn’t have an internet address, the router will construct an internet address based on the conversion options specified in the global domain document. We do this at several sites and it works like a charm.
Oh, of course you must make sure your endusers can’t change internet addresses in person documents!
Subject: RE: Strip inetfrom and principal field from outgoing internet mail
Gerco,
Wow, pretty impressive solution! I know about server docs in Administrator, but I never heard of configuration docs. I followed your advice and located the spot where this configuration would be done. I didn’t even know there were such settings. Thanks for the tip!
Ken
Subject: RE: Strip inetfrom and principal field from outgoing internet mail
Hello!
Could you ore somebody else send me a screenshot of this configuration document?
Thx!
Martin (martin.schlager@profactor.at)