[Tickets #12678] Re: Incorrect sender address for e-mail notifications

[noreply at bugs.horde.org]

DO NOT REPLY TO THIS MESSAGE. THIS EMAIL ADDRESS IS NOT MONITORED.

Ticket URL: https://bugs.horde.org/ticket/12678
------------------------------------------------------------------------------
  Ticket             | 12678
  Updated By         | horde at stefanseidel.info
  Summary            | Incorrect sender address for e-mail notifications
  Queue              | Kronolith
  Version            | 4.1.3
  Type               | Bug
  State              | Feedback
  Priority           | 1. Low
  Milestone          |
  Patch              |
  Owners             |
------------------------------------------------------------------------------


horde at stefanseidel.info (2016-05-31 06:10) wrote:

>> I'm still pondering whether it's not some kind of anti-spam
>> protection to use the recipient as the sender, so that you are only
>> able to send notifications if your authorized to do so.
> Any opinions on that, anyone?

Thinking about this again, the $conf[reminder] setting is probably  
crucial. It should be possible to define a fixed sender (+auth),  
because it's not always the case that the user is also a valid email  
sender. I.e. it is possible to have users with email addresses  
external to the Horde server, and in that case sending with that email  
from the Horde server would be wrong and potentially forbidden by SPF  
or other rules.

Is it desirable to try sending the mail without authentication first  
and then use the stored credentials?

Using the default e-mail address of the owner of the calender doesn't  
really change the situation here I think, because how can it be  
ensured that _this_ address can be used for sending mail without  
authentication?

The only other solution I could think of would be to let the users  
decide how to send emails "in their name" when they are not logged in,  
potentially requiring them to save their mail credentials in the  
settings. I don't think we want to go down that route?

Since I'm also interested in making this work for me, I could take a  
look at the $conf[reminder] settings and see how to make them work if  
noone else is already planning to work on this.