Bug 1071: fix delivery logging with untrusted macros.

[exim.git] / src / src / exim.c

diff --git a/src/src/exim.c b/src/src/exim.c
index f1c3199c31793ac074be60e62eef0363779c20a7..e236975061be2c14ee851ac0979a200b8cb90ddd 100644 (file)
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -3338,9 +3338,13 @@ if ((                                            /* EITHER */
   and should be used for any logging information because attempts to write
   to the log will usually fail. To arrange this, we unset really_exim. However,
   if no stderr is available there is no point - we might as well have a go
-  at the log (if it fails, syslog will be written). */
+  at the log (if it fails, syslog will be written).
 
-  if (log_stderr != NULL) really_exim = FALSE;
+  Note that if the invoker is Exim, the logs remain available. Messing with
+  this causes unlogged successful deliveries.  */
+
+  if ((log_stderr != NULL) && (real_uid != exim_uid))
+    really_exim = FALSE;
   }
 
 /* Privilege is to be retained for the moment. It may be dropped later,