Seemingly random replytoemail address when none is set

[larsnikander]

We've experienced an issue when adding a send email workflow to a form with no ReplyToEmail set, where the email gets a seemingly random email as reply to email instead (most likely from another form entry, but it's difficult to tell).

Reproduction

Bug summary

When submitting a form with a Send Email workflow, with no ReplyToEmail attached to it the client experiences that the reply to email attribute of the email send is an email that isn't tied to the entry. A Seemingly random email, although they do say that the emails that are chosen for the reply to email might be from other entries in the system.

The client has 50+ different forms and many of them contains the send email workflow that sends a copy of the data to the administration for verification or handling. It happens that the administration chooses "reply to" in their email program and if they don't catch this error early then they might send out personal information to the wrong recipient.

For now we have instructed them to not use reply to in any form emails, and to update all send email workflows with a value in ReplyToEmail to avoid any leaks in the current system, but we hope that there is a solution to this issue.

Specifics

Umbraco 8.6.4 with Umbraco forms 8.4.2
Using Sendgrid as SMTP Server
Issue is only noticed in forms using the Send Email workflow

Steps to reproduce

We have difficulty reproducing the bug locally and in our test environment, but live it seems like it's everytime a form is created with a send email workflow that contains nothing in the ReplyToEmail.

Expected result

Would like to have the ReplyToEmail set to Sender Email by default if nothing is set.

Actual result

The ReplyToEmail attribute is set to an email from another form entry.

[nul800sebastiaan]

Hi @larsnikander that's not great. 😓.
I have found the issue and have fixed for 8.4.3.

Until 8.4.3 is out you can fix it for now by changing your Workflow definitions:

This is where the problem occurs, if the ReplyToEmail is set to null.. when it's "" (empty string), it won't have this problem.

Alternatively you can use the files from this nightly build, then you don't need to update your definitions:

UmbracoForms.Files.8.5.3-alpha.20201012.2.zip

Note that you will need to copy over all the files and you will get an upgrade to version 8.5.3. The default in 8.5.3 config is that StoreUmbracoFormsInDb is set to False. I would recommend to keep it that way while we fix some other bugs for when that setting is set to True. So keep it False for now. 👍

[larsnikander]

Thank you for your reply, we will update it immediately for the current workflows.

Have I understood it correctly that we actively need to update all future workflows as well if we don't want to update to the 8.5.3 nightly build right away?

[nul800sebastiaan]

Yes, I am not sure when it saves with an empty string or when it saves with a null. So future forms could definitely be affected :-(

[nul800sebastiaan]

I'll close this in anticipation of the 8.5.4 release, I am not sure when we can get it out yet though.