The manual states that the NOPOST option takes precidence over the Editor=
keyword, but states nothing about the precidence of the REVIEW option.  It
does state that the REVIEW option cancels the EDITOR option, but that might
not extend to the Editor= keyword.


-----Original Message-----
From: Randy Ryan [mailto:[log in to unmask]]
Sent: Wednesday, September 12, 2001 12:05 AM
To: [log in to unmask]
Subject: Re: Mailer security problem


>If the originator is a member of OUR-KIDS, then that person is an Editor
>(because you have (OUR-KIDS) on the Editor= line) and does not need
>approval.

With the caveat that if the subscriber is on REVIEW, as was stated with my
initial post, their posts are supposed to go to the editor for approval.

I think this is like the @home problem where the email goes from the list
to  an isp through a couple of other mail routers and gets redirected back
to the list address without being caught as a duplicate nor sent to the
moderator for approval.

IMHO this is a security problem waiting to be exploited.


>*  Send= Editor, Hold
>*  Editor= [log in to unmask], (OUR-KIDS)

Randy