diff options
| author | Julien Castiaux <juc@odoo.com> | 2020-07-08 12:04:33 +0000 |
|---|---|---|
| committer | Julien Castiaux <juc@odoo.com> | 2020-07-29 23:44:47 +0000 |
| commit | f1215389e85b74d302b2f494ef055c4d16e6c48c (patch) | |
| tree | edbb88805d3b46146ed3f881bcb3258318aff5a0 /addons | |
| parent | dc8973fd6e44975fc79af184282434b0aa1c11aa (diff) | |
[FIX] mail: prevent international char in alias
Create a mail alias with non-ascii characters like 'foß', send an
email from your personal email account to that alias. The delivery fails
because Odoo SA servers don't support the SMTPUTF8 extension which is
required to parse the local-part ("display" <local-part@domain>) part of
a From header.
While external providers may create international, very weird, emails
and we should support receiving/sending emails from/to them. Our policy
is to only create very basic email addresses. That is all ASCII,
letters, digits and a limited set of punctuation characters.
Restricting what aliases can be created, we ensure no advanced extension
should be enabled on SMTP servers.
opw-2293336
Closes #53403
closes odoo/odoo#55166
X-original-commit: 4db3f21f52fa774ec651fc0b6eaa9a8652b2ae4c
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Signed-off-by: Julien Castiaux <Julien00859@users.noreply.github.com>
Diffstat (limited to 'addons')
| -rw-r--r-- | addons/mail/i18n/mail.pot | 6 | ||||
| -rw-r--r-- | addons/mail/models/mail_alias.py | 15 |
2 files changed, 21 insertions, 0 deletions
diff --git a/addons/mail/i18n/mail.pot b/addons/mail/i18n/mail.pot index ef08e37e117..aede0a36756 100644 --- a/addons/mail/i18n/mail.pot +++ b/addons/mail/i18n/mail.pot @@ -6359,6 +6359,12 @@ msgid "" msgstr "" #. module: mail +#: code:addons/mail/models/mail_alias.py:89 +#, python-format +msgid "You cannot use anything else than unaccented latin characters in the alias address." +msgstr "" + +#. module: mail #: code:addons/mail/models/mail_thread.py:0 #, python-format msgid "You have been assigned to %s" diff --git a/addons/mail/models/mail_alias.py b/addons/mail/models/mail_alias.py index 22d49564f99..3c08bb168d6 100644 --- a/addons/mail/models/mail_alias.py +++ b/addons/mail/models/mail_alias.py @@ -8,6 +8,10 @@ from odoo import _, api, fields, models from odoo.exceptions import ValidationError, UserError from odoo.tools import remove_accents, is_html_empty +# see rfc5322 section 3.2.3 +atext = r"[a-zA-Z0-9!#$%&'*+\-/=?^_`{|}~]" +dot_atom_text = re.compile(r"^%s+(\.%s+)*$" % (atext, atext)) + class Alias(models.Model): """A Mail Alias is a mapping of an email address with a given Odoo Document @@ -75,6 +79,17 @@ class Alias(models.Model): ('alias_unique', 'UNIQUE(alias_name)', 'Unfortunately this email alias is already used, please choose a unique one') ] + @api.constrains('alias_name') + def _alias_is_ascii(self): + """ The local-part ("display-name" <local-part@domain>) of an + address only contains limited range of ascii characters. + We DO NOT allow anything else than ASCII dot-atom formed + local-part. Quoted-string and internationnal characters are + to be rejected. See rfc5322 sections 3.4.1 and 3.2.3 + """ + if self.alias_name and not dot_atom_text.match(self.alias_name): + raise ValidationError(_("You cannot use anything else than unaccented latin characters in the alias address.")) + def _compute_alias_domain(self): alias_domain = self._default_alias_domain() for record in self: |