> ChangeLog, 4.93 :-
>
> JH/32
> Introduce a general tainting mechanism for values read from the input
> channel, and values derived from them. Refuse to expand any tainted
> values, to catch one form of exploit.
Ok, so the problem was not in Sieve operation itself, but in the fact that
a Sieve script was read (expanded) from a path that contained $local_part?
If so, why was the script executed?
What's the suggested way to do that for virtual domains, that is many
mailboxes that all belong to the same local user, and which are not
obtained through a lookup, but through the filesystem itself?
Michael
