A bug was reported in the Discourse email system where the email domain blacklist was not consulted when receiving emails and creating staged users. schungx identified the issue in the email/receiver.rb file and suggested a solution to check the email domain against the blacklist using EmailValidator.validate_each before creating a staged user.
The proposed fix involves:
Performing initial checks
Checking if the user with the email address already exists
If not, validating the email address against the blacklist
If not blacklisted, creating the user
Continuing processing
jomaxro confirmed that gerhard committed the fixes to prevent staged user creation when the email domain is blacklisted. However, riking pointed out a typo in one of the commits, which was later corrected by gerhard.
When an email is received, Email.Receiver only checks the following:
Regexp.new(SiteSetting.ignore_by_title) =~ @mail.subject // Blacklisted TOPIC TITLE
raise BouncedEmailError if is_bounce? // Bounce mail
raise NoSenderDetectedError if @from_email.blank? // No From field
raise ScreenedEmailError if ScreenedEmail.should_block?(@from_email) // Screend Email address
After this, a new staged user is created via find_or_create_user.
The result is, when an email is received via email in, the originator address is not checked whether it is from a blacklisted domain.
EmailValidator.validate_each should be called on @from_email.
The procedure should be:
Do the checks above
Further check first if the user with that email address already exists (find_user?). If so, let it pass.
If the email address doesn’t exist, call EmailValidator.validate_each to check if it is blacklisted. DO NOT create a staged user if the email domain is blacklisted.
If not blacklisted, then create the user (create_user?)
Wonder if anyone is working on this… It gets a bit inconvenient to keep having spammers create staged accounts when i know I should be able to blacklist them.
I can confirm @zogstrip is aware of this. We actually ran into this with one of our customers - they were being flooded by “spam” accounts whose domains were already blacklisted.