Why doesn MHonArc, by default, use the specified filename when saving attachments?
A malicious person could send a message with an attachment filename that could overwrite existing content or be interpreted by the web server in some special manner to execute actions. Example: Apache allows for the support for creating .htaccess files to allow configuration settings within a directory. If you have this feature enabled and a message containes an attachment with the specified filename .htaccess and MHonArc blindly used the attachment filename, the attachment will override any existing .htaccess file you created with a version defined by the sender of the message. Another possibility is that web servers sometimes interpret filenames with certain extensions as executable content, like .shtml, .cgi, .phtml. If MHonArc used the attachment filename, or even just the attachment filename extension, anyone who can send mail that will be archived on your site can introduce executable content. It is because of the above reasons that the m2h_external::filter documented in the MIME
