Files
discourse/app/controllers/admin/email_controller.rb
T
Isaac Janzen 4c0367f774 DEV: Strip unsubscribe links when sending digest previews to arbitrary addresses (#38298)
# Problem

When an admin sends a digest preview to an arbitrary email address, the
email contained functional unsubscribe links belonging to the target
user, allowing the recipient to unsubscribe that user without their
consent.

# Solution

Pass `skip_unsubscribe_links: true` when generating preview digests,
which skips `UnsubscribeKey` creation and suppresses unsubscribe content
from both email headers and body templates at the source.
2026-03-05 13:58:51 -06:00

136 lines
3.7 KiB
Ruby

# frozen_string_literal: true
class Admin::EmailController < Admin::AdminController
def index
end
def server_settings
data = { delivery_method: delivery_method, settings: delivery_settings }
render_json_dump(data)
end
def test
params.require(:email_address)
begin
message = TestMailer.send_test(params[:email_address])
Email::Sender.new(message, :test_message).send
render json: { sent_test_email_message: I18n.t("admin.email.sent_test") }
rescue => e
render json: { errors: [e.message] }, status: :unprocessable_entity
end
end
def preview_digest
params.require(:last_seen_at)
params.require(:username)
user = User.find_by_username(params[:username])
raise Discourse::InvalidParameters unless user
renderer = Email::Renderer.new(UserNotifications.digest(user, since: params[:last_seen_at]))
render json: MultiJson.dump(html_content: renderer.html, text_content: renderer.text)
end
def advanced_test
params.require(:email)
receiver = Email::Receiver.new(params["email"])
text, elided, format = receiver.select_body
render json: success_json.merge!(text: text, elided: elided, format: format)
end
def send_digest
params.require(:last_seen_at)
params.require(:username)
params.require(:email)
user = User.find_by_username(params[:username])
raise Discourse::InvalidParameters unless user
message, skip_reason =
UserNotifications.public_send(
:digest,
user,
since: params[:last_seen_at],
skip_unsubscribe_links: true,
)
if message
message.to = params[:email]
begin
Email::Sender.new(message, :digest).send
render json: success_json
rescue => e
render json: { errors: [e.message] }, status: :unprocessable_entity
end
else
render json: { errors: skip_reason }
end
end
# TODO (martin) Remove this in 3.7.0, this endpoint has been broken for years
# and was used only in the public mail-receiver's fast rejection code,
# which is removed in https://github.com/discourse/mail-receiver/pull/33
def smtp_should_reject
render json: { reject: false }
end
def handle_mail
deprecated_email_param_used = false
if params[:email_encoded].present?
email_raw = Base64.strict_decode64(params[:email_encoded])
elsif params[:email].present?
deprecated_email_param_used = true
email_raw = params[:email]
else
raise ActionController::ParameterMissing.new("email_encoded or email")
end
retry_count = 0
begin
Jobs.enqueue(
:process_email,
mail: email_raw,
retry_on_rate_limit: true,
source: "handle_mail",
)
rescue JSON::GeneratorError, Encoding::UndefinedConversionError => e
if retry_count == 0
email_raw = email_raw.force_encoding("iso-8859-1").encode("UTF-8")
retry_count += 1
retry
else
raise e
end
end
if deprecated_email_param_used
warning =
"warning: the email parameter is deprecated. all POST requests to this route should be sent with a base64 strict encoded email_encoded parameter instead. email has been received and is queued for processing"
Discourse.deprecate(warning, drop_from: "3.3.0")
render plain: warning
else
render plain: "email has been received and is queued for processing"
end
end
private
def delivery_settings
action_mailer_settings.reject { |k, _| k == :password }.map { |k, v| { name: k, value: v } }
end
def delivery_method
ActionMailer::Base.delivery_method
end
def action_mailer_settings
ActionMailer::Base.public_send "#{delivery_method}_settings"
end
end