Project

General

Profile

Actions

Defect #4139

closed

Emails from no-reply redmine's address hell cycle

Added by Roland Discein over 14 years ago. Updated over 12 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
Email receiving
Target version:
Start date:
2009-10-30
Due date:
% Done:

0%

Estimated time:
Resolution:
Fixed
Affected version:

Description

Hello, coders!
I wish to share with u the bug i've found.

Please correct me if I wrong, but it seems since unknown_user feature was added, there are possible troubles with spam email letters may occur.
Desire such installation:
We have system-wide email for responding "";
We have several projects, "A", "B", and "C";
With our redmine we parsing different email addresses for adding issues to projects with uncnown_user=create and specific project= options enabled, including redmine email address, for example, , , ;

Once upon a day, we receive a spam letter where the sender equals recipient and unfortunately equals one of our emails..
For example, letter from to .
Then, application does the following:

creating user named according to spam letter;
sending letter 1 (with projectc's password) from to ;

creating issue 1 (with spam body) in project C;
sending letter 2++ (about issue 1 created) from to ,
which in cycle becomes new followups of issue 1;

creating issue 2 (with projectc's credentials) in project C;
sending letter 3++ (about issue 2 created) from to ;
which in cycle becomes new followups of issue 2;

creating user named according to Letter 1;
sending letter 4 (with myredmine's password) from to ;

creating issue 3 (with myredmine's credentials) in project A;
sending letter 5++ (about issue 3 created) from to ;
which in cycle becomes new followups of issue 3...

Maybe this sequence is wrong, but algorythm is clear and from one hell letter (or because of lack of brains) we have 3 infinitely growing issues, which wasting rails time and eating disk space.


Only one solution I've found quickly - to add users with system and projects emails and uncheck all notification options for them.

Maybe the community offers another solution to prevent such email cycling.
Any suggestions?

Actions

Also available in: Atom PDF