Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!uunet!wang!fitz
From: fitz@wang.com (Tom Fitzgerald)
Newsgroups: comp.mail.elm
Subject: Nasty bug, sends reply to wrong person
Message-ID: <axiucc.569@wang.com>
Date: 12 Dec 90 02:16:59 GMT
Organization: Wang Labs, Lowell MA, USA
Lines: 60

I found a neat way to embarrass myself.  My boss received a mailmessage and
forwarded it to me, and I replied to it.  Elm informed me that it was
sending the reply to my boss.  But it didn't, it sent the reply to the
person who had sent the original message.  Do you see the possibility for
problems in this situation?

The configuration is SCO Unix, with MMDF as a mailer, Elm set up to use
MMDF-format mailboxes.  Elm is PL8.  Boring details follow.

My boss, myboss@wang.com got the original message from
person1@office.wang.com, and saved it to a folder.  Since Elm's set up to
use MMDF format files, the folder began with the standard:

^A^A^A^A
From office.wang.com!person1 <timestamp>
From: person1@office.wang.com (Original Sender)
Subject: Original Subject
To: myboss@wang.com
etc...

(For the uninitiated, MMDF uses the string of ^As as a message separator.)
Boss forwarded it by piping it into mail: "mail -s 'Subject' fitz < folder"

When it showed up in my mailbox, the first ^A had been replaced by a space
(I don't know by whom) but the other ^As were intact, and the message
looked like:

^A^A^A^A
From elf.wang.com!myboss <timestamp>
From: myboss@wang.com (Fitz's Boss)
X-Mailer: SCO System V Mail (version 3.2)
To: fitz
Subject: Subject

 ^A^A^A
From office.wang.com!person1 <timestamp>
From: person1@office.wang.com (Original Sender)
Subject: Original Subject
To: myboss@wang.com
etc...

(It starts getting interesting now).  When I replied to it, Elm showed me
the "To: Fitz's Boss" on the right while it was prompting me for the
subject.  When I sent it, person1 got it instead.  The message Elm sent
had in its header:

To: person1@office.wang.com (Fitz's Boss)

which is the most intriguing part - it combined the fullname from the real
header with an address found only in the body of the message, and made the
result the destination of the reply.  Elm definitely built it that way
because I went through the same procedure and looked at the outgoing
message headers, and that's what the header screen showed.

I haven't had time to look at the code, and may not for a while; if anyone
has any ideas, I'd be curious.

---
Tom Fitzgerald   Wang Labs        fitz@wang.com
1-508-967-5278   Lowell MA, USA   ...!uunet!wang!fitz