Category not accepting "anonymous email" from known users

Reproduce:

  1. Have a “private” category that only has create/reply/see access for members of a specific group. No other permissions.
  2. Enable “anonymous email in” for that specific via a unique working alias to the incoming POP account.
  3. Have a non-staff user that is not a member of the group send an email report in to the category email address from the email address associated with their account.
  4. Send in an email from an account not associated with any known Discourse account.

Expected Behavior:

  • Both #3 and #4 result in new topics in the private category, and the group can begin discussion.

Actual Behavior:

  • The email in #4 works but email in #3 is rejected with the can_create? failed error.
6 Likes

@zogstrip can you review this?

Is this still a problem?

I’m no longer running a site with incoming email enabled so unfortunately can’t reproduce to say either way.

2 Likes

Pretty sure #3 still isn’t working.

When we receive an email, we first try to associate it to a user, and then we check for permissions. Since the user isn’t part of the group, they can’t post.

The email_in_allow_strangers field on the category only works for staged users.

1 Like

Can confirm #3 still not working. Is the best workaround right now to have emails directed at a group rather than a category? Not my preferred arrangement but I can switch until a patch comes out.

1 Like

I don’t think we can ever support #3 unless we add another setting that opens up any incoming emails?

This scenario seems to be replaced these days with the group functionality as a type of workaround, although I could see some use cases that it might still be just as valuable for categories/topics/discussions.

Sounds plausible. Is this a big thing to do?

Like you say, this is just a (bad) workaround. IMO this should be controllable on a per-category level. Clearly a bug that this works only for anonymous but not for known users.

1 Like

I just ran into this issue while trying to set up a category for our organizations info list. This category only allows a certain group to access it, but we selected the option to allow emails from anonymous users. Email addresses that are not associated with any of our discourse users can send a message that will show up in the category, but registered users that are not in the group get rejected due to “Insufficient Trust Level”. I think I understand the technical reason why it works this way (only works for staged users) but is there a reason why this would be the desired or expected behavior? It seems to me if we are choosing to allow anonymous users we probably want to allow all registered users as well.

We ran into this issue with our site this past week as well. For us, the situation is as follows:

While most of our categories are intended to be for registered users only, we wanted to have a way for a non-member of the community to make contact with the core developers by email to ask a quick question, raise a concern, etc.

We did this by setting up a category to accept emails from anonymous users using a custom address (e.g., ourproject+contact@discoursemail.com). We made the category’s permissions readable only by core project members to avoid generating too much mail or noise for the community at large (which meant making topics create-able and reply-able by core members as well since there’s no way to restrict read access without also limiting create/reply access).

However, we then learned that if the anonymous user went on to create an official account, they could no longer send mails to the contact email address. This seems counter-intuitive in that they are now only more official and registered than they were before, but can do strictly less than they could before.

This caused me a great degree of confusion before I came across this topic, and still seems like an unfortunate situation.

-Brad

1 Like