<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1141" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hi,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I have recently installed the release version of
RT3 onto a new server for testing as my company would like to switch over to
using a ticketing system rather than standard email.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I have noticed one odd thing with the way it
processes mail (although it may be my setup but I can't see where), if there is
a user on the system, e.g. autocreated by opening a ticket, they can reply to
any other ticket by simply changing the number in the subject of the message and
this reply will be forwarded onto the ticket requestor.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>This does not seem correct to me as it would allow
a spammer to randomly guess ticket numbers and then send mail to our customers
using rt as the relay.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>The only permissions I have set are to allow is for
"Everyone" to be able to create tickets, no specific permissions are set for
replying to tickets but RT still lets the mail through.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Have I made a mistake in the setup or is this a
loophole in the program?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Cheers</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>James</FONT></DIV></BODY></HTML>