On 26 Jul 99, at 11:55, Deborah Cresswell wrote:

>
> When I send the post from the Web Interface, it gets distributed without
> me having to approve it at the Editors address!  I thought this was very
> strange being as all postings need to be approved!!  Any thoughts?

Mail-merge is not a regular post to the list. Mail-merge creates a special
"distribute" job, using the addresses in the list as the source of data.
It does not follow _any_ of the list's rules, it follows the mail-merge
distribute job rules.

> I subsequently tried to send a mailmerge posting to the MM test list
> from my E-mail client.  This e-mail seemed to disappear into a black
> hole.  I didn't have to approve it and it never got distributed!!

Sounds like you don't have LSMTP 1.1b, or you don't have mail-merge
enabled. As documented, mail-merge can ONLY be done with LSMTP 1.1b. The
LSMTP host must be configured to accept mail-merge jobs from LISTSERV, and
LISTSERV has some configuration issues as well:

> I am therefore concerned about the security levels on this subject and
> this method of posting to a list.

The only people allowed to send mail-merge jobs through LISTSERV are the
addresses listed as postmaster and in the DIST_ALLOWED_USERS parameter in
your site configuration file. In addition, if the site configuration file
sets the DIST_OWNER_MAIL_MERGE parameter to 1, then list owners are
permitted to send mail-merge jobs to their own list. The reason for the
existence of the latter parameter is that list owners may not know whether
LSMTP 1.1b is being used as the SMTP_FORWARD* for LISTSERV, whereas the
LISTSERV maintainer (and by extension the dist_allowed_users) _should_
know what the SMTP host is running.

More information about mail-merge is in the Developer's manual:

http://www.lsoft.com/manuals/1.8d/developer/developer.html#4.1.3
http://www.lsoft.com/manuals/1.8d/developer/developer.html#4.4.1
http://www.lsoft.com/manuals/1.8d/developer/developer.html#4.6


Francoise