RocketChat / RocketChat/Rocket.Chat
Refactoring email sending
@sampaiodiego is already working on this.
Since Apr 13, 2017.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
I investigated a bit for #6192 and #6195 and the way Rocket.Chat is sending email is... I'd say a bit messy, let me detail
- various methods are used in the wild: ( Mailer.sendMail, Email.send, Accounts.sendResetPasswordEmail )
- these methods are used sometimes differently
And here I can see a potential security issue:
https://github.com/RocketChat/Rocket.Chat/blob/07efe5a2ab79931e4bd45cd63f58c88857eaec4c/packages/rocketchat-mailer/client/views/mailer.coffee#L9
Looks like you let the user define the from field.
Which means, as an email provider, my reputation can get lowered by a spammer using my rocket.chat instance.
IMHO, we need to refactor these, to make it easier to understand what is going on.
I guess we need:
- make all emails going though: Mailer.sendMail
- make sure this method is working well
- make sure this method is reading everything from MAIL_URL
- Maybe add a FROM_EMAIL env var that this method would understand, this would allow unattended rocket.chat full configuration
- make accounts emails, also use this method, this way, they would get styled also (footer - header)
- log things to allow to run in debug mode to understand better what is going on
What is the normal way to proceed? Should we open an issue for each item? What is your general opinion on that matter?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.