Bad CSRF with mailgun replies

Support
5

TL;DR:

I don’t believe Mailgun’s mail forwarding will work as-is with Discourse. It doesn’t pass the email data in the right way and there doesn’t appear to be a way to change that on either end Mailgun nor Discourse.

The detail

Within Mailgun’s documentation there is a Django code example which indicates what is passed to the HTTP endpoint by mailguns forward functionality.

An example payload at the bottom of this page confirms this.

For reference here is the code sample:

Consider this Django code:

# Handler for HTTP POST to http://myhost.com/messages for the route defined above
def on_incoming_message(request):
     if request.method == 'POST':
         sender    = request.POST.get('sender')
         recipient = request.POST.get('recipient')
         subject   = request.POST.get('subject', '')

         body_plain = request.POST.get('body-plain', '')
         body_without_quotes = request.POST.get('stripped-text', '')
         # note: other MIME headers are also posted here...

         # attachments:
         for key in request.FILES:
             file = request.FILES[key]
             # do something with the file

     # Returned text is ignored but HTTP status code matters:
     # Mailgun wants to see 2xx, otherwise it will make another attempt in 5 minutes
     return HttpResponse('OK')

Note that this means that many POST parameters including sender, recipient, subject, body-plain, stripped-text and files as separate “chunks”.

This is not what Discourse expects to be sent to the /admin/email/handle_mail endpoint - it simply wants the complete raw email as the email parameter.