I have a question on the new Zend security vulnerability announced by Magento recently regarding the email settings in System-> Configuration-> Advanced-> System-> Mail Sending Settings-> Set Return-Path
What exactly does having this set to YES do?
Other than negating the security vulnerability, I would like to understand what feature I'm loosing by setting this to No. I tested this on our staging site by setting it to NO but I see no difference as a user, after I received a sales email, it still can see how it came from the same email address and I could reply to it.
I checked their User Guide, but unfortunately it did not reveal much more.
Under closer inspection I see that the email headers change slightly when I adjust this setting, especially the ones noted below:
When Set to YES
Return-Path: <email@example.com> From: Sales <firstname.lastname@example.org>
When Set to SPECIFIED
Return-Path: <email@example.com> From: Sales <firstname.lastname@example.org>
When Set to NO
Return-Path: <email@example.com> From: Sales <firstname.lastname@example.org>
Now I have a new question how does revealing your IP address & server username by changing the setting to NO help secure your Magento website?
Also, If I swicth from SENDMAIL to POSTFIX, will this solve the problem?