I recently installed Discourse on Linux, and I had a user contact me via another means saying that he tried to send me an email via the messaging service on Discourse and that I didn’t respond. I started playing around with the messaging function to see if could figure out what was happening and while doing that I found that I could send an email to anybody on the internet that I wanted to through the messaging service, rather than just to other users. I consider that to be a big security risk as it appears that any user could send email to anyone and they would receive it from the email address of my Discourse server. Is this intended behavior, and if so, is there anyway to change it? What I’d like to have happen is that users can only send private messages to other users and I’d prefer that they be required to use the userid of the other user rather than their email address. I’m running version 2.7.0.beta3.

It is intended, see the announcement: Send a Personal Message to an Email Address [image] srwsol: I consider that to be a big security risk as it appears that any user could send email to anyone and they would receive it from the email address of my Discourse server. This is true of most platforms that have an email invite system, is there any additional risk by using a Discourse PM instead? You can disable the feature by turning off the site setting Automatically create staged users when processing incoming emails (because sending an email from a PM requires the creation of a staged user)

No, it does not impact invite emails as those do not expect a response.

[image] awesomerobot: Automatically create staged users Thanks very much for the assistance! The setting works.

Personal messages can be sent to email addresses?

Product Support

srwsol February 12, 2021, 7:01pm 3

Will that disable the “invite” function as well, as I do want to use that, at least for someone with moderator or admin authority.

Topic		Replies	Views
Send a Personal Message to an Email Address Announcements new-feature	16	4991	January 13, 2022
Sites who want real email addresses and no private messaging Feature	1	1125	May 19, 2017
Email response as private message Product Support	4	2165	February 19, 2021
(Mailing List) Link to private message Feature	10	2869	November 24, 2015
Message a user via email Product Support	1	369	October 17, 2022

Personal messages can be sent to email addresses?

Related topics