Mailing list mirroring bug with security implications

You could argue that because the message is the same it has a single message-id. In fact, for the example in question, the original poster composed the message in Gmail (which assigned the message-id) and it was sent to two listserv addresses on the same server. This isn’t uncommon, for example, it could be a news release common to managers and clinicians, each of which sit on their own mailing lists. There may be a medical issue within the news release that needs discussion, so a clinician might reply (and the Reply-to: address would have been set to the clinician list even though the To: header still had both mailing lists mentioned). Similarly the managers might wish to discuss their own view of the news. They would reply and the relevent Reply-to: header used to reflect the managers’ list. Had one poster made use of the To: addresses by doing a ‘reply all’ a bounce message would have been generated from the list they weren’t a member of.

The above behaviour isn’t that unusual but it seems Discourse can’t handle it correctly if used as a mailing list mirror and keep the forked replies separate as they will all be pegged to the original message-id and the category in which that post first appeared.

This could mean managers could see the posts of clinicians for example, if the clinician, responding to the clinician list, had that post appear in the mirror of the managers list due to the way discourse files messages.

A solution could be to check each address in the To: header of incoming messages to see if it matched a mailing list mirror address in each of the Category settings. If it did, a copy of the message could be posted in each matching category, and there could be several copies potentially of the post in different categories. Then if any replies came in the message-id could be used, as is currently the case, but only if the To: line matched the category as well.