1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-11 08:06:13 +01:00
phorge-phorge/src/applications/metamta
epriestley caaa1394ef Don't count "Cc: x@y.com" as a legitimate recipient if the user who has "x@y.com" attached to their account has not verified the address
Summary:
Fixes T13317. On `admin.phacility.com`, an enterprising user added `noreply@admin.phacility.com` to their account. This caused them to become CC'd on several support issues over the last year, because we send mail "From" this address and it can get CC'd via reply/reply all/whatever else.

The original driving goal here is that if I reply to a task email and CC you on my reply, that should count as a CC in Phabricator, since this aligns with user intent and keeps them in the loop.

This misfire on `noreply@` is ultimately harmless (being CC'd does not grant the user access permission, see T4411), but confusing and undesirable. Instead:

  - Don't allow reserved addresses ("noreply@", "ssladmin@", etc) to trigger this subscribe-via-CC behavior.
  - Only count verified addresses as legitimate user recipients.

Test Plan:
  - Added a `bin/mail receive-test --cc ...` flag to make this easier to test.
  - Sent mail as `bin/mail receive-test --to X --as alice --cc bailey@verified.com`. Bailey was CC'd both before and after the change.
  - Sent mail as `bin/mail receive-test --to X --as alice --cc unverified@imaginary.com`, an address which Bailey has added to her account but not verified.
    - Before change: Bailey was CC'd on the task anyway.
    - After change: Bailey is not CC'd on the task.

Reviewers: amckinley

Reviewed By: amckinley

Maniphest Tasks: T13317

Differential Revision: https://secure.phabricator.com/D20593
2019-06-19 12:51:00 -07:00
..
action When we fail to process mail, tell the user about it 2014-04-03 18:43:18 -07:00
adapter Allow "SMTP" and "Sendmail" mailers to have "Message-ID" behavior configured in "cluster.mailers" 2019-03-16 12:35:55 -07:00
application Support Postmark inbound mail via webhook 2018-02-08 06:25:26 -08:00
applicationpanel Replace "getRequestURI()->setQueryParams(array())" with "getPath()" 2019-02-12 14:43:33 -08:00
command Use PhutilClassMapQuery 2015-07-07 22:51:57 +10:00
constants Don't bounce mail messages if any recipient was reserved 2019-01-17 19:17:37 -08:00
contentsource Modularize content sources 2016-03-26 11:59:45 -07:00
controller Make the mobile menu available in "/mail/" 2019-02-05 14:10:57 -08:00
edge MetaMTA - more progress towards a mail application 2015-06-23 11:37:14 -07:00
editor Prevent application email addresses from shadowing user email addresses 2019-01-16 13:28:08 -08:00
engine Fix bad "$this" references in "Must Encrypt" mail after MailEngine changes 2019-01-24 15:07:42 -08:00
engineextension Manage object mailKeys automatically in Mail instead of storing them on objects 2018-04-25 06:46:58 -07:00
exception Apply some autofix linter rules 2014-09-10 06:55:05 +10:00
future Add a Duo API future 2019-01-24 15:10:17 -08:00
garbagecollector Support DestructionEngine in MetaMTAMail 2018-02-02 14:37:33 -08:00
herald Prevent "Call webhooks" Herald action from appearing in UI for adapters which can't fire it 2018-02-11 06:15:29 -08:00
management Don't count "Cc: x@y.com" as a legitimate recipient if the user who has "x@y.com" attached to their account has not verified the address 2019-06-19 12:51:00 -07:00
message Give "MetaMTAMail" a "message type" and support SMS 2019-01-23 14:05:46 -08:00
parser Extend from Phobject 2015-06-15 18:02:27 +10:00
phid Mark PhabricatorPHIDType::getPHIDTypeApplicationClass() as abstract 2015-11-03 06:47:12 +11:00
query Allow multiple mail receivers to react to an individual email 2019-01-16 12:28:02 -08:00
receiver Update Mail test adapter for the newer adapter API and make all tests pass 2019-01-16 13:01:25 -08:00
replyhandler Drop empty inbound mail at the beginning of the receive workflow, not inside object handlers 2019-01-04 13:50:21 -08:00
stamp Fix a mail stamp issue with blocking reviewers 2018-02-13 17:56:21 -08:00
storage Don't count "Cc: x@y.com" as a legitimate recipient if the user who has "x@y.com" attached to their account has not verified the address 2019-06-19 12:51:00 -07:00
typeahead Fix packages(project) to work properly and add it to "MailableFunctionDatasource" 2018-10-19 13:53:27 -07:00
util Prevent application email addresses from shadowing user email addresses 2019-01-16 13:28:08 -08:00
view Rename "MetaMTA" mail attachments and add more mail message objects 2019-01-04 15:23:44 -08:00
PhabricatorMetaMTAWorker.php Send permanent dameon failures to the log, even when not running in verbose mode 2017-06-08 15:26:19 -07:00