CC'ing my reply to Newsguy >Perhaps you should talk to the newsguy admins, perhaps they >can suppress >the "Approved-by:" line, but the from being the original poster would >seem to me to be what you want. That way, the subscribers >REVIEW/NOREVIEW status would control the post. Nope, that's the problem. The From, Reply-to, and Sender lines remains intact. The only difference is the Approved line. WU's mail server does some kind of relaying, but I don't see how that could be affecting the REVIEW command when the post is coming from Newsguy. Here's a sample: Approved-By: [log in to unmask] Message-Id: <[log in to unmask]> Date: Tue, 8 Dec 1998 08:58:59 -0500 Reply-To: Jeffrey Punch <[log in to unmask]> Sender: "Organ transplant recipients and anyone else intested in the issues." <[log in to unmask]> From: Jeffrey Punch <[log in to unmask]> Organization: University of Michigan Subject: Re: [TRNSPLNT] Prednisone To: [log in to unmask] I don't know what the headers look like when the message is sent to the server though. The non-subscribers posts I'm sent for approval look like this: Received: from GATEWAY by enews with netnews for [log in to unmask] ([log in to unmask]) To: [log in to unmask] Date: Tue, 08 Dec 1998 23:27:04 -0700 From: Robert Schuh <[log in to unmask]> Message-ID: <[log in to unmask]> Organization: "I don't think so. Homie don't play that!" Sender: [log in to unmask] References: <[log in to unmask]> The only thing I see here is that the Sender is Newsguy, but, once again, that address is not subscribed. The Newsguy subscription is under another address. If all that is necessary to subvert REVIEW is the insertion of any old Approved header, isn't this a serious bug? I'll see if Mike at Newsguy.com can give me a sample of how the headers look from his server. ======================================================================= Mike Holloway |* On average, 9 people/day on the waiting [log in to unmask] lists die for lack of a donor. ________________________|* The end-stage diseases treated by transplant do not recognize age, race, nationality or pocketbook. * There is no justifiable reason to deny organ donation, but many myths and misunderstandings. * Next of kin must allow donation. Your family must know your wishes. * Only a small fraction of the next of kin of potential donors allow donation to take place. * In general, medical professionals do not recognize their obligation to support and promote donation. Questions? See FAQ: http://www.faqs.org/faqs/by-newsgroup/bit/bit.listserv.transplant.html ======================================================================