Skip to content

fix(iMIP): Prevent mails from carrying an unrelated user's name - #62580

Merged
DerDreschner merged 1 commit into
masterfrom
fix/prevent-imip-sender-leak
Aug 17, 2026
Merged

fix(iMIP): Prevent mails from carrying an unrelated user's name#62580
DerDreschner merged 1 commit into
masterfrom
fix/prevent-imip-sender-leak

Conversation

@DerDreschner

@DerDreschner DerDreschner commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR fixes an issue in the iMIP component of Nextcloud.

When the iTip message contains no (optional) CN property for the person we're sending the iMIP message on behalf of, we're using the display name of the current session user to fill out the sender for iMIP messages. This means we're sending out mails with the correct mail address, but wrong display name. Example how it's sent out right now, although it should say "A":

From: "B via Nextcloud" <noreply@...>
Reply-To: "B" <a@test.example>

This is especially the case when using Thunderbird, as it doesn't set the CN property.

To solve the issue, this PR implements the following steps:

  1. Does the mail address matches with one of the current session user's addresses? If so, we're still using the display name of the current session.
  2. If we don't know any user with that mail address, we're falling back to a neutral From: "Nextcloud" <noreply...>; Reply-To: <a@test.example>

Checklist

AI (if applicable)

  • The content of this PR was partly or fully generated using AI

@DerDreschner DerDreschner self-assigned this Jul 27, 2026
@DerDreschner DerDreschner added bug 3. to review Waiting for reviews feature: caldav Related to CalDAV internals AI assisted labels Jul 27, 2026
@DerDreschner

Copy link
Copy Markdown
Contributor Author

/backport to stable34

@DerDreschner

Copy link
Copy Markdown
Contributor Author

/backport to stable33

@DerDreschner

Copy link
Copy Markdown
Contributor Author

/backport to stable32

@DerDreschner
DerDreschner marked this pull request as ready for review July 27, 2026 12:26
@DerDreschner
DerDreschner requested review from come-nc, leftybournes, provokateurin and salmart-dev and removed request for a team July 27, 2026 12:26
@DerDreschner
DerDreschner enabled auto-merge July 27, 2026 13:16
@DerDreschner
DerDreschner force-pushed the fix/prevent-imip-sender-leak branch from 35a2ff6 to 13acc22 Compare July 28, 2026 14:08
@SebastianKrupinski

Copy link
Copy Markdown
Contributor

Hey,

I had a quick look and read and I think we are going to have to make this change further down in the schedule() function, there are two sending code paths, one for sending via system mail the other using mail provider (user own email address)

When sending using the mail provider we use the email address that is original provided in the event to match a email account in the mail provider.

So it should be:

System mail -> Set display name -> Set reply to address
Mail Provider -> use address to match account

@DerDreschner

Copy link
Copy Markdown
Contributor Author

@SebastianKrupinski I'm not sure what you mean. The display name for the mail is being set independently from this setting, before and after this PR. Could you get more into detail?

@DerDreschner
DerDreschner force-pushed the fix/prevent-imip-sender-leak branch from 13acc22 to 3f1e76d Compare July 31, 2026 14:24
Assisted-by: ClaudeCode:claude-fable-5
Signed-off-by: David Dreschner <david.dreschner@nextcloud.com>
@DerDreschner
DerDreschner force-pushed the fix/prevent-imip-sender-leak branch from 3f1e76d to 96f04ec Compare August 12, 2026 16:14
@DerDreschner
DerDreschner merged commit 66a98bd into master Aug 17, 2026
199 checks passed
@DerDreschner
DerDreschner deleted the fix/prevent-imip-sender-leak branch August 17, 2026 08:48
@DerDreschner

Copy link
Copy Markdown
Contributor Author

/backport to stable31

@DerDreschner

Copy link
Copy Markdown
Contributor Author

/backport to stable30

@backportbot

backportbot Bot commented Aug 17, 2026

Copy link
Copy Markdown

The backport to stable31 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable31
git pull origin stable31

# Create the new backport branch
git checkout -b backport/62580/stable31

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 96f04ec9

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/62580/stable31

Error: Failed to check for changes with origin/stable31: No changes found in backport branch


Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

@DerDreschner

Copy link
Copy Markdown
Contributor Author

/backport to stable29

@backportbot

backportbot Bot commented Aug 17, 2026

Copy link
Copy Markdown

The backport to stable30 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable30
git pull origin stable30

# Create the new backport branch
git checkout -b backport/62580/stable30

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 96f04ec9

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/62580/stable30

Error: Failed to check for changes with origin/stable30: No changes found in backport branch


Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

@backportbot

backportbot Bot commented Aug 17, 2026

Copy link
Copy Markdown

The backport to stable29 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable29
git pull origin stable29

# Create the new backport branch
git checkout -b backport/62580/stable29

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 96f04ec9

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/62580/stable29

Error: Failed to check for changes with origin/stable29: No changes found in backport branch


Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants