-2

I have an old website and I just can't find the script that generated emails with these headers:

Return-Path: <username-www@server.com>
Delivered-To: support@example.com
Received: (qmail 46814 invoked by uid 89); 9 Oct 2012 14:06:48 -0000
Delivered-To: example.com-cs@example.com
Received: (qmail 46800 invoked by uid 89); 9 Oct 2012 14:06:48 -0000
Received: from unknown (HELO bmf.server.com) (83.98.198.11)
  by server.com with SMTP; 9 Oct 2012 14:06:48 -0000
Received-SPF: none (server.com: domain at server.com does    not     designate permitted sender hosts)
X-Recieved: Authenticated device
X-Recieved: Authenticated device
X-Recieved: Authenticated device
Date: Tue, 9 Oct 2012 10:06:34 -0400 (EDT)
Message-Id: <201210091406.q99E6Y14009874@server.com>
To: cs@example.com
Subject: Assistance request sent from Customer Support page
From:no-reply@example.com
Content-Type: text/html; charset=ISO-8859-1

Are the any logs where it says by what script the email with id:201210091406.q99E6Y14009874@server.com was generated?

Cœur
  • 37,241
  • 25
  • 195
  • 267
rinchik
  • 2,642
  • 8
  • 29
  • 46

2 Answers2

3

If you do not or cannot make server log changes, simply do a text search within all files in your site for the string 'Assistance request sent from Customer Support page'. Possibly the subject could either be hardcoded in the email script, or be loaded from a config file, or from the database. A full file search will help you track down if it is one of the first two cases.

If you don't find it, do a query on the database (if you have any email config tables) which might contain this value. If there is such a record in the database, you can then run another search which queries that table and sends emails out with those values

raidenace
  • 12,789
  • 1
  • 32
  • 35
  • I did. Found just one script but there is no support@mysite.com or cs@mysite.com in there script sends emails to different addresses. – rinchik Oct 09 '12 at 22:12
  • are the different addresses hardcoded or variables? – raidenace Oct 09 '12 at 22:15
  • There are no config files or database records about this emails. – rinchik Oct 09 '12 at 22:15
  • yep. there are a couple addresses hardcoded but not the support@mysite.com or cs@mysite.com (the actual receivers) – rinchik Oct 09 '12 at 22:17
  • 1
    hmmm..two scenarios that come to mind.. One -you might want to check that the hardcoded email addresses are not aliases to support@mysite or cs@mysite.com. Second - these two email addresses could be catch-all email addresses for the domain. So suppose the hardcoded email address is blah-blah@mysite.com and if such an email address does not exist, the emails get dropped to catch-all address (In such cases the original to address should be retained though..) Anyways, might help to enable mail.log and check it too.. – raidenace Oct 09 '12 at 22:20
1

See the mail.log (string) PHP setting, it allows you to track mails that get send via the mail() function and shows filenames and line numbers:

The path to a log file that will log all mail() calls. Log entries include the full path of the script, line number, To address and headers.

All you need to do is to enable it and then check for the mail.

Enabling mail.add_x_header in your PHP configuration then would allow you even to see in the next email which script was involved.

hakre
  • 193,403
  • 52
  • 435
  • 836