loading up the forgejo repo on tangled to test page performance
Prevent multiple `To` recipients (#22566)
Change the mailer interface to prevent leaking of possible hidden email
addresses when sending to multiple recipients.
Co-authored-by: Gusted <williamzijl7@hotmail.com>
+23
-20
+1
-1
routers/private/mail.go
+1
-1
routers/private/mail.go
+6
-6
services/mailer/mail.go
+6
-6
services/mailer/mail.go
···
61
61
// No mail service configured
62
62
return nil
63
63
}
64
-
return gomail.Send(Sender, NewMessage([]string{email}, "Gitea Test Email!", "Gitea Test Email!").ToMessage())
64
+
return gomail.Send(Sender, NewMessage(email, "Gitea Test Email!", "Gitea Test Email!").ToMessage())
65
65
}
66
66
67
67
// sendUserMail sends a mail to the user
···
86
86
return
87
87
}
88
88
89
-
msg := NewMessage([]string{u.Email}, subject, content.String())
89
+
msg := NewMessage(u.Email, subject, content.String())
90
90
msg.Info = fmt.Sprintf("UID: %d, %s", u.ID, info)
91
91
92
92
SendAsync(msg)
···
137
137
return
138
138
}
139
139
140
-
msg := NewMessage([]string{email.Email}, locale.Tr("mail.activate_email"), content.String())
140
+
msg := NewMessage(email.Email, locale.Tr("mail.activate_email"), content.String())
141
141
msg.Info = fmt.Sprintf("UID: %d, activate email", u.ID)
142
142
143
143
SendAsync(msg)
···
168
168
return
169
169
}
170
170
171
-
msg := NewMessage([]string{u.Email}, locale.Tr("mail.register_notify"), content.String())
171
+
msg := NewMessage(u.Email, locale.Tr("mail.register_notify"), content.String())
172
172
msg.Info = fmt.Sprintf("UID: %d, registration notify", u.ID)
173
173
174
174
SendAsync(msg)
···
202
202
return
203
203
}
204
204
205
-
msg := NewMessage([]string{u.Email}, subject, content.String())
205
+
msg := NewMessage(u.Email, subject, content.String())
206
206
msg.Info = fmt.Sprintf("UID: %d, add collaborator", u.ID)
207
207
208
208
SendAsync(msg)
···
322
322
323
323
msgs := make([]*Message, 0, len(recipients))
324
324
for _, recipient := range recipients {
325
-
msg := NewMessageFrom([]string{recipient.Email}, ctx.Doer.DisplayName(), setting.MailService.FromEmail, subject, mailBody.String())
325
+
msg := NewMessageFrom(recipient.Email, ctx.Doer.DisplayName(), setting.MailService.FromEmail, subject, mailBody.String())
326
326
msg.Info = fmt.Sprintf("Subject: %s, %s", subject, info)
327
327
328
328
msg.SetHeader("Message-ID", msgID)
+1
-1
services/mailer/mail_release.go
+1
-1
services/mailer/mail_release.go
···
89
89
publisherName := rel.Publisher.DisplayName()
90
90
relURL := "<" + rel.HTMLURL() + ">"
91
91
for _, to := range tos {
92
-
msg := NewMessageFrom([]string{to}, publisherName, setting.MailService.FromEmail, subject, mailBody.String())
92
+
msg := NewMessageFrom(to, publisherName, setting.MailService.FromEmail, subject, mailBody.String())
93
93
msg.Info = subject
94
94
msg.SetHeader("Message-ID", relURL)
95
95
msgs = append(msgs, msg)
+6
-3
services/mailer/mail_repo.go
+6
-3
services/mailer/mail_repo.go
···
82
82
return err
83
83
}
84
84
85
-
msg := NewMessage(emails, subject, content.String())
86
-
msg.Info = fmt.Sprintf("UID: %d, repository pending transfer notification", newOwner.ID)
85
+
for _, to := range emails {
86
+
msg := NewMessage(to, subject, content.String())
87
+
msg.Info = fmt.Sprintf("UID: %d, repository pending transfer notification", newOwner.ID)
88
+
89
+
SendAsync(msg)
90
+
}
87
91
88
-
SendAsync(msg)
89
92
return nil
90
93
}
+1
-1
services/mailer/mail_team_invite.go
+1
-1
services/mailer/mail_team_invite.go
+5
-5
services/mailer/mailer.go
+5
-5
services/mailer/mailer.go
···
35
35
Info string // Message information for log purpose.
36
36
FromAddress string
37
37
FromDisplayName string
38
-
To []string
38
+
To string // Use only one recipient to prevent leaking of addresses
39
39
ReplyTo string
40
40
Subject string
41
41
Date time.Time
···
47
47
func (m *Message) ToMessage() *gomail.Message {
48
48
msg := gomail.NewMessage()
49
49
msg.SetAddressHeader("From", m.FromAddress, m.FromDisplayName)
50
-
msg.SetHeader("To", m.To...)
50
+
msg.SetHeader("To", m.To)
51
51
if m.ReplyTo != "" {
52
52
msg.SetHeader("Reply-To", m.ReplyTo)
53
53
}
···
89
89
dateMs := m.Date.UnixNano() / 1e6
90
90
h := fnv.New64()
91
91
if len(m.To) > 0 {
92
-
_, _ = h.Write([]byte(m.To[0]))
92
+
_, _ = h.Write([]byte(m.To))
93
93
}
94
94
_, _ = h.Write([]byte(m.Subject))
95
95
_, _ = h.Write([]byte(m.Body))
···
97
97
}
98
98
99
99
// NewMessageFrom creates new mail message object with custom From header.
100
-
func NewMessageFrom(to []string, fromDisplayName, fromAddress, subject, body string) *Message {
100
+
func NewMessageFrom(to, fromDisplayName, fromAddress, subject, body string) *Message {
101
101
log.Trace("NewMessageFrom (body):\n%s", body)
102
102
103
103
return &Message{
···
112
112
}
113
113
114
114
// NewMessage creates new mail message object with default From header.
115
-
func NewMessage(to []string, subject, body string) *Message {
115
+
func NewMessage(to, subject, body string) *Message {
116
116
return NewMessageFrom(to, setting.MailService.FromName, setting.MailService.FromEmail, subject, body)
117
117
}
118
118
+3
-3
services/mailer/mailer_test.go
+3
-3
services/mailer/mailer_test.go
···
21
21
setting.Domain = "localhost"
22
22
23
23
date := time.Date(2000, 1, 2, 3, 4, 5, 6, time.UTC)
24
-
m := NewMessageFrom(nil, "display-name", "from-address", "subject", "body")
24
+
m := NewMessageFrom("", "display-name", "from-address", "subject", "body")
25
25
m.Date = date
26
26
gm := m.ToMessage()
27
27
assert.Equal(t, "<autogen-946782245000-41e8fc54a8ad3a3f@localhost>", gm.GetHeader("Message-ID")[0])
28
28
29
-
m = NewMessageFrom([]string{"a@b.com"}, "display-name", "from-address", "subject", "body")
29
+
m = NewMessageFrom("a@b.com", "display-name", "from-address", "subject", "body")
30
30
m.Date = date
31
31
gm = m.ToMessage()
32
32
assert.Equal(t, "<autogen-946782245000-cc88ce3cfe9bd04f@localhost>", gm.GetHeader("Message-ID")[0])
33
33
34
-
m = NewMessageFrom([]string{"a@b.com"}, "display-name", "from-address", "subject", "body")
34
+
m = NewMessageFrom("a@b.com", "display-name", "from-address", "subject", "body")
35
35
m.SetHeader("Message-ID", "<msg-d@domain.com>")
36
36
gm = m.ToMessage()
37
37
assert.Equal(t, "<msg-d@domain.com>", gm.GetHeader("Message-ID")[0])