RocketChat / RocketChat/Rocket.Chat

Refactoring email sending

Open
#6,196 5 comments 4 reactions 2 assignees View on GitHub

@sampaiodiego is already working on this.

Since Apr 13, 2017.

feat: email triaged type: improvement
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

I investigated a bit for #6192 and #6195 and the way Rocket.Chat is sending email is... I'd say a bit messy, let me detail

  • various methods are used in the wild: ( Mailer.sendMail, Email.send, Accounts.sendResetPasswordEmail )
  • these methods are used sometimes differently

And here I can see a potential security issue:
https://github.com/RocketChat/Rocket.Chat/blob/07efe5a2ab79931e4bd45cd63f58c88857eaec4c/packages/rocketchat-mailer/client/views/mailer.coffee#L9
Looks like you let the user define the from field.
Which means, as an email provider, my reputation can get lowered by a spammer using my rocket.chat instance.

IMHO, we need to refactor these, to make it easier to understand what is going on.

I guess we need:

  • make all emails going though: Mailer.sendMail
  • make sure this method is working well
  • make sure this method is reading everything from MAIL_URL
  • Maybe add a FROM_EMAIL env var that this method would understand, this would allow unattended rocket.chat full configuration
  • make accounts emails, also use this method, this way, they would get styled also (footer - header)
  • log things to allow to run in debug mode to understand better what is going on

What is the normal way to proceed? Should we open an issue for each item? What is your general opinion on that matter?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.