Add allow self singed in mail setting

[peterhashair]

Description:

Fixes: #18563
add allow self singed in mail setting

Review

• Functional review done
• Potential edge cases thought about (behavior of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• Documentation added if needed
• Existing documentation updated if needed

[sgiehl]

@peterhashair Weren't @mattab's requirements defined in #18563 (comment) clear enough? Wondering why you implemented only one ini setting instead of the three settings he requested 🤔

[Findus23]

I would also change the wording of the setting. allow_self_signed implies this allows an additional mode of operation and something that has a limited impact of security (it feels like "only one more thing to support").
But what the setting in fact does is completely remove all TLS verification, allowing anyone in-between Matomo and the mail server to intercept, read and modify e-mails without any issues. (and the fact this also makes self signed certs work is just a side-effect)
So the setting should make it clear that this has strong security implications and should only be set if the person exactly understands what it means and that it is fine in their environment (e.g. the mail server is on localhost)

[peterhashair]

@sgiehl ops update it.

[justinvelluppillai]

This would actually be 4.13.0 if this is merged before the next release. Otherwise potentially 4.13.1

[sgiehl]

Added some suggestions for text improvements. Otherwise guess this should work as expected.

[sgiehl]

Looks good to me now.

[mattab]

Sorry i forgot to mention, but here I would expect that we surface the existence of these settings to the user when they get the error, say change the message from:

SMTP Error: Could not connect to SMTP host.

(as found in the original issue)

to something helpful to users to find it directly like:

SMTP Error: Could not connect to SMTP host. If you use a SMTP server with a self-signed certificate, see this FAQ: LINK_TO_FAQ

and additionally create a new short FAQ to document the settings.

Note: Just seeing i had mentioned it in #18563 (comment)

[sgiehl]

@mattab That might be not that easy to implement. The error message is coming from PHPMailer, which throws a normal \Exception. We could look at the error message, but PHPMailer has messages that are translated to the requested language. Also those messages might change with every release of PHPMailer, so if we look for a certain message, that might start failing with each release of PHPMailer in any language.
What we could do is provide some sort of fake language file for PHPMailer, that will be used. That will ensure that we always get the same error messages. But it would mean, that we would need to do the translation manually afterwards, or even provide all of them through our translation system.
Not sure if that's worth the effort. If you think that's important enough to spent the time on it, feel free to reopen the related issue or create a new one for it.

[mattab]

Sounds good - then we just need to Create a FAQ that mentions the console error message + the solution with the new INI setting (so that people searching for the error will find it) eg. "How do I configure Matomo to send emails when a self-served certificate is used, or SSL doesn't work?"