2 ms·
You have a tracking image embedded in the emails. It points at a redirector script which does no validation of the destination url. This is highly abusable. Exa
by mike-cardwell 16y ago
You have a tracking image embedded in the emails. It points at a redirector script which does no validation of the destination url. This is highly abusable. Example:
http://r.posterous.com/track/?redirect=http%3A%2F%2Fgoogle.com%2F http://r.posterous.com/track/?redirect=http%3A%2F%2Fgoogle.c...
- mike-cardwell 16y agoOuch. It looks like you've done this on purpose. If I send an email with a link to the list, the link in the email I get back bounces through r.posterous.com. This will be abused by spammers...
- mike-cardwell 16y agoOk. You have yet another open redirector here: http://posterous.com/logout?jumpto= http://posterous.com/logout?jumpto= Not good...
- a4agarwal 16y agoThanks, Mike. We're fixing this up right now.
- mike-cardwell 16y agoAnd yet it's still not fixed.