Skip to content

fix(mails): resend each selected mail to its own recipients - #90

Open
rmeekers wants to merge 1 commit into
backstagephp:5.xfrom
rmeekers:fix/bulk-resend-keeps-each-mails-recipients
Open

rmeekers wants to merge 1 commit into
backstagephp:5.xfrom
rmeekers:fix/bulk-resend-keeps-each-mails-recipients

Conversation

@rmeekers

Copy link
Copy Markdown

Problem

The bulk Resend action on the mails table builds one form for all selected mails: its To, CC and BCC fields are prefilled with the union of the addresses of every selected mail. On submit, each selected mail is resent to that whole list.

So selecting two mails, one sent to Ann and one to Bob, and confirming the prefilled form sends Ann's mail to Ann and Bob, and Bob's mail to Ann and Bob. With transactional mail (personal links, codes, invoices) that discloses one recipient's content to everyone else in the selection. The prefilled form makes this the default path rather than a misuse.

Change

  • The bulk action no longer has a recipient form. Each selected mail is resent to its own to, cc and bcc.
  • The confirmation says so: "Each selected mail is sent again to its own recipients."
  • getBulkResendForm() is removed. Changing recipients remains possible on the single-row Resend action, which only ever concerns one mail.
  • A test that a bulk resend of two mails with different recipients queues each mail for its own recipients only.

PHPStan reports seven method.notFound errors in ListMails.php on 5.x already; this PR does not touch them.

The bulk Resend action prefilled one recipient form with every address of every
selected mail and then sent each selected mail to that whole list. Resending
mails that went to different people therefore delivered each of them to all the
other recipients as well, which leaks personal content between recipients.

The bulk action now sends every selected mail again to its own to, cc and bcc,
without a shared form. Changing the recipients stays possible on the single
Resend action.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant