revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-27 01:02:42 +01:00
Code Issues Releases Wiki Activity

Mask the sender for "Must Encrypt" mail

Browse source 
Summary:
Depends on D18998. Ref T13053. When we send "Must Encrypt" mail, we currently send it with a normal "From" address.

This discloses a little information about the object (for example, if the Director of Silly Walks is interacting with a "must encrypt" object, the vulnerability is probably related to Silly Walks), so anonymize who is interacting with the object.

Test Plan: Processed some mail. (The actual final "From" is ephemeral and a little tricky to examine and I didn't actually transmit mail over the network, but it should be obvious if this works or not on `secure`.)

Reviewers: amckinley

Reviewed By: amckinley

Maniphest Tasks: T13053

Differential Revision: https://secure.phabricator.com/D19000
This commit is contained in:
epriestley 2018-02-06 04:28:03 -08:00
parent 1485debcbd
commit 7765299f83
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/applications/metamta/storage/PhabricatorMetaMTAMail.php
View file

@ -592,6 +592,12 @@ final class PhabricatorMetaMTAMail
$mailer->setFrom($from_email, $from_name); $mailer->setFrom($from_email, $from_name);
break; break;
case 'from': case 'from':
// If the mail content must be encrypted, disguise the sender.
if ($must_encrypt) {
$mailer->setFrom($default_from, pht('Phabricator'));
break;
}
$from = $value; $from = $value;
$actor_email = null; $actor_email = null;
$actor_name = null; $actor_name = null;