Page MenuHomePhabricator
Files F13993763

D842.id.diff
No OneTemporary
Actions

D842.id.diff
View Options

Index: conf/default.conf.php
===================================================================
--- conf/default.conf.php
+++ conf/default.conf.php
@@ -243,6 +243,16 @@
// Email" in the documentation for more information.
'metamta.maniphest.public-create-email' => null,
+ // If you enable 'metamta.public-replies', Phabricator uses "From" to
+ // authenticate users. You can additionally enable this setting to try to
+ // authenticate with 'Reply-To'. Note that this is completely spoofable and
+ // insecure (any user can set any 'Reply-To' address) but depending on the
+ // nature of your install or other deliverability conditions this might be
+ // okay. Generally, you can't do much more by spoofing Reply-To than be
+ // annoying (you can write but not read content). But, you know, this is
+ // still **COMPLETELY INSECURE**.
+ 'metamta.insecure-auth-with-reply-to' => false,
+
// -- Auth ------------------------------------------------------------------ //
Index: src/applications/metamta/storage/receivedmail/PhabricatorMetaMTAReceivedMail.php
===================================================================
--- src/applications/metamta/storage/receivedmail/PhabricatorMetaMTAReceivedMail.php
+++ src/applications/metamta/storage/receivedmail/PhabricatorMetaMTAReceivedMail.php
@@ -224,9 +224,26 @@
$from = idx($this->headers, 'from');
$from = $this->getRawEmailAddress($from);
- return id(new PhabricatorUser())->loadOneWhere(
+ $user = id(new PhabricatorUser())->loadOneWhere(
'email = %s',
$from);
+
+ // If Phabricator is configured to allow "Reply-To" authentication, try
+ // the "Reply-To" address if we failed to match the "From" address.
+ $config_key = 'metamta.insecure-auth-with-reply-to';
+ $allow_reply_to = PhabricatorEnv::getEnvConfig($config_key);
+
+ if (!$user && $allow_reply_to) {
+ $reply_to = idx($this->headers, 'reply-to');
+ $reply_to = $this->getRawEmailAddress($reply_to);
+ if ($reply_to) {
+ $user = id(new PhabricatorUser())->loadOneWhere(
+ 'email = %s',
+ $reply_to);
+ }
+ }
+
+ return $user;
}
}

File Metadata

Mime Type
text/plain
Expires
Thu, Oct 24, 1:16 AM (1 w, 5 d ago)
Storage Engine
blob
Storage Format
Encrypted (AES-256-CBC)
Storage Handle
6745548
Default Alt Text
D842.id.diff (2 KB)

Event Timeline

Phabricator · Built by Phacility