[Plugin: Postie] All Emails Being Treated As Possible XSS Attacks & Blocked

I agree joel, if you’re posting to a unique email address and only verified people can post, isn’t this security enough? And if the email address does get hacked, isn’t there flood protection? And a simple change of email address should set it straight.

I forgot to mention in my previous email – Postie is one of a kind plug-ins. I have been searching for a new plug-in – I found one; this plug-in requires me to load into WordPress each time eNewsletter was sent out. I don’t have time to do that. And this plugin is no longer support or available – the company created this plugin is gone.

It is my hope there would be a paid version which allows more features and on-going upgrade. I believe Postie is one of the best (and still the only one) – I hope the author would do two versions – basic Postie for free and Advance Postie for a fee.

Hmmm… Same to me. Only TEXT mails work fine.
Have installed version 1.4.4.
POP3 SSL neither working

Any news from someone to this?

Regards,
Knut

I am also having this problem, however I am using a slightly different setup to most. I am publishing from a Gapps email address. When I manually send an email to this account, it gets posted without any problems. However I am also sending emails to this account from a Google Docs spreadsheet using a Google Script (I’m using the spreadsheet to automatically generate the html code that I want to get posted). Any emails sent from the spreadsheet get flagged as possible XSS attacks (and I have added the Gapps account to the approved ‘users’ in Postie).

@joyfulart,

Then what’s the point of the “Authorized Addresses” section. That section is different than the user, per the description: “Posts from emails in this list will be treated as if they came from the admin. If you would prefer to have users post under their own name – create a WordPress user with the correct access level.”

This differentiates “authorized users” (addresses who post as the admin) from regular users (addresses who post as themselves).

Same problem for me. Sure hope there will be an update soon.

Is it possible to install a older version?

I ended up just pulling the entire section of code because, like others, I could not see what was in the plain text mails that was running afoul of the new code. I did @joyfulart’s suggestion to check/add the user to no avail. I made the change using the plugin editor within WP by commenting out the lines. (// in front of each)

Probably not the best solution and I’ll continue to follow this thread hoping someone figures it out.

Here is the postie test log after I removed the XSS code… perhaps someone can comment on what part of “script|onload|meta|base64” this might be running afoul of…

**********************
memory at start of e-mail processing:29427464
Confirming Access For usersname@att.net
posting as user 2

Message Id is :<002101cd80de$30b9a420$922cec60$@usersname@att.net>

primary= multipart, secondary = alternative
primary= text, secondary = plain

Post Author: 2
Date: 2012-08-22 21:20:04
Category: 3
Ping Status: open
Comment Status: closed
Subject: Where Do You Find?
Postname: where-do-you-find
Post Id: 567
Posted content:

(large blob here of plain text looking email)

memory at end of e-mail processing:29512368
**********************

I pulled all of this:

// check for XSS attacks - we disallow any javascript, meta, onload, or base64
    if (preg_match("/.*(script|onload|meta|base64).*/is", $email)) {
      echo "possible XSS attack - ignoring email\n";
      continue;
    }