faulty contact us form with noreplyaddress configdirective

Bug #738263 reported by Scott Korvek on 2011-03-19
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mahara
Medium
Nigel Cunningham

Bug Description

I am using Mahara 1.3.3 clean install on shared hosting with inmotionhosting, linux php 5.3, mysql. Everything works, but my emails sent by mahara are getting blocked. I had the same problem with my moodle installation, but was able to configure it with SMTP email and a defined, working noreply address. However, this is not working with mahara.

The mail is actually sent, but is blocked at the destination because the user's profile email address is being used as the from field, instead of the noreplyaddress as defined. Since the email is coming from another domain, but claiming to be from the same domain as the recipient, it's blocked by the receiving mailserver (rightfully so).

In doing the testing, I was following the troubleshooting info on the wiki and using the contact us form to send the test emails. Peeking around the code I see that that is a rather "crude" form that takes the email given and passes it on to phpmailer as the from address. The from email field is autopopulated since I am logged in, so the noreplyaddress is never used in this case.

After fixing other problems, the contact form submissions still get blocked (obviously). In a case where the noreplyaddress config directive is set, the form should be smart enough to substitute that address for the entered address (or better yet-- apply that address to the reply-to address, and use the noreply address as the "from" or "sender" fields to comply with proper envelope format and accepted relay rules) since in effect mahara is using the mailserver as a relay.

If that can't be done, perhaps you could include a switch to turn off the contact form and replace it with a email address url for contact (mailto) so the person trying to contact the admin can use their own mail system (less ideal I guess).

Lastly, until this is fixed, and possibly after, the troubleshooting docs shouldn't suggest using this form to troubleshoot email since the form itself is the problem!

Forum post with complete details: http://mahara.org/interaction/forum/topic.php?id=3110#post13442

François Marier (fmarier) wrote :

I'll have to think about this one a bit more because we personally do make use of the fact that the emails are made to appear as though they are sent by users directly.

For Mahara.org, we feed the contact us emails directly into an automated system (request tracker) which automatically emails the user back with a ticket number. We wouldn't want to break this.

However, maybe we should just forget about the whole mail form and just have a standard mailto: link.

Changed in mahara:
status: New → Triaged
importance: Undecided → Medium
milestone: none → 1.4.0
Changed in mahara:
milestone: 1.4.0 → none
tags: added: contactus
Melissa Draper (melissa) wrote :

We should check if rt prioritises Reply-To: over From:

If it does, perhaps we should use that.

Changed in mahara:
milestone: none → 1.6.0
tags: added: bite-sized
Changed in mahara:
status: Triaged → Confirmed
Melissa Draper (melissa) on 2012-09-05
Changed in mahara:
milestone: 1.6.0 → 1.7.0
Aaron Wells (u-aaronw) on 2013-04-19
Changed in mahara:
milestone: 1.7.0 → 1.8.0
Changed in mahara:
milestone: 1.8.0rc1 → none
Son Nguyen (ngson2000) wrote :

I think we can fix the issue by

1. Replace the 'From' field by noreply address, and store the user's email address in 'Reply-to' field
2. Reconfigure the request tracking system of mahara.org.

Nigel Cunningham (nigelc-g) wrote :

Patch submitted. Would someone please review?

Changed in mahara:
assignee: nobody → Nigel Cunningham (nigelc-g)
status: Confirmed → In Progress
Ghada El-Zoghbi (ghada-z) wrote :

I'm not sure that putting the user's email in the reply-to address will solve this issue.

if a user's email is to be hidden, putting it in the 'Reply-to' is not really hiding it.

Any email client will allow them to view the headers and they can then see the Reply-To email.

Nigel Cunningham (nigelc-g) wrote :

Hi Ghada.

If I've understood things correctly, the point wasn't to hide the email address, but rather to enable messages to be delivered that would otherwise rightly be rejected (see the OP's description).

Imagine I'm using a Mahara installation running on mahara.example.org. My email address is <email address hidden> and I attempt to send a message to <email address hidden>. With the configuration described above, mahara.example.org will attempt to send a message claiming to be from <email address hidden>. If user2.net is properly configured, it will reject mahara.example.org's attempt at sending the email because mahara.example.org is not user1.org. If on the other hand mahara.example.org attempts to send an email from <email address hidden> with a Reply-to of <email address hidden>, the message should be accepted.

Changed in mahara:
milestone: none → 1.10.0

Reviewed: https://reviews.mahara.org/3447
Committed: http://gitorious.org/mahara/mahara/commit/a8ddcf27cc3eaab7124098cb05629b2811eaed78
Submitter: Aaron Wells (<email address hidden>)
Branch: master

commit a8ddcf27cc3eaab7124098cb05629b2811eaed78
Author: Nigel Cunningham <email address hidden>
Date: Tue Jun 17 08:57:05 2014 +1000

Send email from noreply address (Bug #738263)

Per bug 738263, send email from the noreply address and
set the reply-to address to the user email if the
hideemail flag isn't set.

Change-Id: Ia9baa95413a73d3d7408012ae59e5420c65b2d39
Signed-off-by: Nigel Cunningham <email address hidden>

Aaron Wells (u-aaronw) on 2014-09-10
Changed in mahara:
status: In Progress → Fix Committed
Aaron Wells (u-aaronw) on 2014-10-21
Changed in mahara:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers