Skip to content

v1.6.0 — Requester-only inbound replies and guest rate limits

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 18:45
· 99 commits to main since this release
v1.6.0
73aeb69
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release changes how inbound email is matched to tickets. Read
Upgrading before deploying.

Upgrading

  • Inbound replies are accepted only from the ticket's requester. A matched
    email becomes a reply only when From is the ticket's guest email or the
    requester's email, and it is posted as the requester. Any other sender,
    including an agent answering a notification by email, gets a new ticket
    instead, and that email no longer reopens a resolved or closed ticket. Agents
    should reply in wp-admin.
  • With an inbound secret set (escalated_email_inbound_secret), only the
    signed Reply-To address links mail to a ticket. Header and subject matching
    are used only when no secret is configured.
  • Guest tickets and replies are rate-limited per client IP (5 tickets and
    10 replies per minute by default). Adjust or disable with the
    guest_rate_limit_enabled, guest_rate_limit_tickets_per_minute and
    guest_rate_limit_replies_per_minute settings or the
    escalated_guest_rate_limit filter. Sites behind a proxy must rewrite
    REMOTE_ADDR from the trusted proxy's forwarded header, or every guest shares
    one budget.

Added

  • Per-IP rate limit on guest tickets and replies. Guest ticket creation (widget REST endpoint and the guest form) is capped at 5 per client IP per minute and guest replies at 10, each with its own counter. Over the limit the request gets 429 with Retry-After. Replies are counted before the guest token is checked, so wrong-token guesses count too. Configure with the guest_rate_limit_enabled, guest_rate_limit_tickets_per_minute and guest_rate_limit_replies_per_minute settings or the escalated_guest_rate_limit filter. Sites behind a proxy must rewrite REMOTE_ADDR from the trusted proxy's forwarded header, or every guest shares one IP.

Fixed

  • Inbound replies come only from the ticket's requester. With an inbound secret set, only the signed Reply-To address links mail to a ticket. A matched email is a reply only when From is the ticket's guest email or requester email, and it is posted as the requester; any other sender gets a new ticket, and only an accepted reply reopens a resolved or closed ticket.
Assets 3
Loading