“Enable staged users” was in fact enabled already. In my case, the user has two accounts on the forum, both live. She replied to a notification from the “other” account and it got rejected by Discourse.
I’ve noticed also that the wording on the setting is a little ambiguous. “Only use reply key” suggests in my mind “don’t additionally validate email address” - but then the setting description says that disabling the setting allows user impersonation. I’ll try disabling the setting and see if that helps.
Was it a reply to a public topic or a group message? The exact error would be interesting too. You can find it in Admin -> Emails -> Rejected. The second account might not be allowed to reply to the topic.
Email addresses are always validated. Each reply key is bound to a topic and user. If they do not match, the email gets rejected. There’s only one exception. If the system knows that an email was forwarded to another user, because that other user was in the To or CC header of a previous reply, than it will allow that user to reply with the forwarded reply key.
In your case, the user needs to send with the correct email address. There’s no way around it. Most email clients should be smart enough to select the right sender address anyway.
Isn’t it a security issue for Discourse to trust the email address in the From header, and to use this as part of its validation of incoming emails? I can set the From header to whatever I like.
The reply key is what protects us from spoofed replies to notification emails. The email address listed in the From field doesn’t offer any real protection at all.
Forgive me for repeating the point, but including email address in the validation of replies is causing user-affecting usability issues and should be dropped IMO
Well I ventured into the Rails console (for the first time!) to add a secondary email address, but my workaround to add the @googlemail.com email to the @gmail.com account and viceversa didn’t work, because the emails have already been taken, of course it makes sense.
If anyone has other ideas to fix this reply by email issue, I’ll be grateful, as I generally am for being able to use Discourse.
Could you let me know what you did to make this work please? I’m still having problems with Discourse rejecting legitimate post-by-emails from users. Very frustrating, trying to explain this issue to the users in question.
Ultimately I’d much prefer if I could just disable the check that Discourse performs on the email address of incoming mails (which is fallible to address spoofing and unnecessary, as the reply key is checked).
I don’t think I really solved it, but it’s been a while and my memory could be failing me.
I tried to add the secondary email address as explained here:
but that didn’t work because the email addresses were taken.
I think the solution would have been to merge the users, though I never proceeded with it because I just talked to the user and she has been using only one of the accounts since, so I can’t tell you how that would have worked in practice, sorry.