"Email in allowed groups" setting is too permissive

joshwhit · January 29, 2024, 3:05pm

Hi all,

We have a self hosted instance of Discourse in mailing list mode, created to be a replacement for mailman

We have 3 categories set up with custom incoming email addresses that create topics, which seemed to be working correctly.

Unfortunately we realised that users without “Create” permissions on the category could create topics by sending emails in.

I tweaked the “Email notifications in” to restrict to the ability to create topics via email to certain privileged groups. Unfortunately users not in the privileged groups can still create topics via email.

I have stopped and started the app and this behavior continued. I have also attempted to update the app to the latest on the tests-passed branch (3.2.0 beta5-dev Commits · discourse/discourse · GitHub) but unfortunately this hasn’t helped. The older build was from around 2 weeks ago

“Category mirrors a mailing list” is ticked for all 3 categories.

It would be great if we could restrict posting via email to specific groups for each category as this would more closely resemble the permissions for the mailing lists we have migrated from.

Replies by email are being denied for users in a way that matches “Reply” in the security settings for the category. It would be great if creating a topic by email was tied to the “Create” settings as well.

Any help or guidance would be greatly appreciated, please let me know if you need any information.

Many thanks

Lilly · January 29, 2024, 4:21pm

Have you read this topic yet?

joshwhit · January 30, 2024, 8:22am

Hi Lillian,

Thanks very much for your message, from reading this documentation it sounds like what we are trying to achieve is the expected behavior from Discourse.

Reading the linked documentation, this part is most relevant:

Why use a category?

Using a category is useful if you want to simulate a mailing list.
We are using categories for this reason
Sending an email to a category will create a topic in said category.
This part is working correctly
Anyone with access to that category may read and reply using the web interface or via email.
This is also working correctly
Emails sent to a category must respect the category’s security settings.
Users who are unable to reply on the Web UI receive a ReplyNotAllowedError when looking at the email logs which is what we want. Users who are unable to create a topic through the web UI are able to create a topic when emailing the incoming email address which is one of the issues we are having. They are even able to create topics in categories they can’t see
Emails sent to a category must respect the email in allowed groups site setting.
I started to use this setting in order to prevent unauthorised groups creating topics in the above way but this doesn’t work either.
You may disable staged users on a per category basis.
Our Discourse instance is invite only so staged users are disabled and any unknown user receives a StrangerNotAllowed error, which is the desired behaviour

I’ve tried stopping and starting the app, and upgrading the app through the web GUI. Would you recommend a full rebuild?

What logs would be most relevant for these issues?

Thanks very much in advance again

joshwhit · January 30, 2024, 9:32am

Hi again,

Just a quick update. I’ve just tried rebuilding the app but the behavior has stayed the same unfortunately. I will try to find some more logs to figure out why this is happening.

joshwhit · January 30, 2024, 11:04am

Hi,

After some digging and testing I’ve found that if you tick “category mirrors a mailing list” this will skip validation as you can see here in the source code

github.com

discourse/discourse/blob/main/lib/email/receiver.rb#L1452


      
          options[:import_mode] = @opts[:import_mode]
          
          options[:via_email] = true
          options[:raw_email] = @raw_email
          
          options[:created_at] ||= @mail.date
          options[:created_at] = DateTime.now if options[:created_at] > DateTime.now
          
          add_elided_to_raw!(options)
          
          if sent_to_mailinglist_mirror?
            options[:skip_validations] = true
            options[:skip_guardian] = true
          else
            options[:email_spam] = is_spam?
            options[:first_post_checks] = true if is_spam?
            options[:email_auth_res_action] = auth_res_action
          end
          
          user = options.delete(:user)

Once I unticked this option then the permissions worked as expected

This then allowed / disallowed based upon permissions as you would expect

Please can this be added to the documentation to help future users?

Thanks very much for your help Lilly.

Topic		Replies	Views
Users are getting "Your account does not have the required trust level..." error message via email Support	10	69	September 9, 2024
Configuring incoming email to create new topics or group messages Site Management how-to , email-in	3	22916	October 21, 2024
Email-in topics not under approvals control Bug	18	1491	April 9, 2018
Mailing list - to a topic Support	12	994	May 17, 2021
Mirroring a read-only mailing list in Discourse Site Management how-to	10	7629	January 14, 2022

"Email in allowed groups" setting is too permissive

Why use a category?

Related topics