"Email in allowed groups" setting is too permissive

Product Support
,
3

Hi Lillian,

Thanks very much for your message, from reading this documentation it sounds like what we are trying to achieve is the expected behavior from Discourse.

Reading the linked documentation, this part is most relevant:

Why use a category?

  • Using a category is useful if you want to simulate a mailing list.
    We are using categories for this reason
  • Sending an email to a category will create a topic in said category.
    This part is working correctly
  • Anyone with access to that category may read and reply using the web interface or via email.
    This is also working correctly
  • Emails sent to a category must respect the category’s security settings.
    Users who are unable to reply on the Web UI receive a ReplyNotAllowedError when looking at the email logs which is what we want. Users who are unable to create a topic through the web UI are able to create a topic when emailing the incoming email address which is one of the issues we are having. They are even able to create topics in categories they can’t see
  • Emails sent to a category must respect the email in allowed groups site setting.
    I started to use this setting in order to prevent unauthorised groups creating topics in the above way but this doesn’t work either.
  • You may disable staged users on a per category basis.
    Our Discourse instance is invite only so staged users are disabled and any unknown user receives a StrangerNotAllowed error, which is the desired behaviour

I’ve tried stopping and starting the app, and upgrading the app through the web GUI. Would you recommend a full rebuild?

What logs would be most relevant for these issues?

Thanks very much in advance again