Commits on Dec 15, 2021

1. [FIX] tools.mail: ignore original email during encapsulation …

   When the system broadcasts an email response to document followers,
   if the config parameters `mail.force.smtp.from` or
   `mail.dynamic.smtp.from` are defined, it will rewrite the `From`
   address to avoid spoofing the sender's domain.
   
   For example, if the `mail.catchall.domain` is set to `example.com` and
   an email response comes from:
   
      "John D" <john@doe.com>
   
   it will rewrite it to:
   
      "John D (john@doe.com)" <notifications@example.com>
   
   This will make sure the system never sends outgoing email for an external
   domain, as it has no authority for doing so, and that could
   break mail filtering/authentication rules (SPF, DMARC, etc.)
   
   During this "encapsulation rewrite step", both the original Sender name
   and their email are preserved, and put into the quoted "name" field of
   the rewritten address. It seems sensible to preserve as much information
   as possible about the original sender.
   
   Unfortunately, the inclusion of the Sender email in the final name makes
   it appear to some inbox providers as if the message is trying to
   deceptively impersonate another person (as many phishing schemes would).
   As of November 2021 GMail at least does this, and will hide the name in
   the UI when it happens. It will keep only the rewritten email, which is not
   very useful in the case of a notification (even though it's more
   technically correct, of course).
   
   This patch removes the original email from the rewritten notification,
   keeping only the name, considering that the email is not the most
   important part, and it's better to have one of the two than none.
   
   So after the patch, the rewritten address is now:
   
      "John D" <notifications@example.com>
   
   When there is no name in the original address, we keep only the local
   part of the email, to avoid the same display issue. The recipient will
   have to identify the sender based on the context / past messages.

   

   odony committed Dec 15, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for d9cc4c5
   • Browse repository at this point

   Copy the full SHA

   d9cc4c5 View commit details

   Browse the repository at this point in the history