Disable need for "confirmation" (ispcp 1.1.10)

[Monotoko]

Personally, I think an option for it would be better, by all means leave it on by default but let us who don't need it as such switch it off... Maybe just disallow the major email hosts to be added? Eg hotmail.com, gmail.com etc

(06-27-2011 03:14 PM)kilburn Wrote:  

Quote:hmmm, ok, you're right for the local server. But from WWW it wouldn't work.

No, obviously not. However, in this example the attacking user would capture all the e-mails that other users of that server send to gmail.com. Bad enough to justify the confirmation procedure IMHO...