[split] Security Problem detected

[joximu]

RatS Wrote:the main problem ATM is that the dns-entry is added on installing domain.

more specific: "domain alias". Only resellers can add "a domain" (with a new user). But the user can add domain aliases which also create dns zones.

You cannot trust the enduser, you should be able to trust the reseller (is the reseller able to find out if a new domain is a valid one or not...).
A view to the registrar of the new domain would give some answers.
A domain alias should be approved by the reseller.

RatS Wrote:There are no further nameserver needed - we have to redesign this.

The dns is very important. Adding an email account to a "domain alias" is the next of the two steps to hijack mails. But if domain aliases are controled then this is also under control.

/J