[18.0][FIX] mail_composer_cc_bcc: prevent Bcc leak and Cc-only emails - #233
Open
divad1196 wants to merge 1 commit into
Open
[18.0][FIX] mail_composer_cc_bcc: prevent Bcc leak and Cc-only emails#233divad1196 wants to merge 1 commit into
divad1196 wants to merge 1 commit into
Conversation
Contributor
|
Hi @trisdoan, |
OCA-git-bot
added
series:18.0
mod:mail_composer_cc_bcc
divad1196
force-pushed
the
fix_email_composer_cc_bcc_lang
branch
4 times, most recently
from
July 15, 2026 21:05
2ffc45f to
be00079
Compare
henrybackman
approved these changes
Jul 21, 2026
simahawk
approved these changes
Jul 27, 2026
Contributor
|
@trisdoan ping |
Due to X-Odoo-Bcc email header, the Bcc were leaking. Report in issue: OCA#142 X-Odoo-Bcc can still be enabled, but is disabled by default. Emails with no `To` were sent due to missing `lang` information. Odoo groups emails using `lang` -> we need to add it as well
divad1196
force-pushed
the
fix_email_composer_cc_bcc_lang
branch
from
July 27, 2026 11:52
ff25a55 to
7e6a409
Compare
Contributor
Author
|
@trisdoan did you get the opportunity to have a look at these changes ? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bcc Leak
Due to X-Odoo-Bcc email header, the Bcc were leaking.
Report in issue: #142
X-Odoo-Bcc can still be enabled, but is disabled by default.
Cc-only emails / Empty To header
Emails with no
Towere sent due to missinglanginformation.Odoo groups emails using
lang-> we need to add it as well.Since the module ensure that we send 1 email per recipients (To+Cc+Bcc),
We can always drop the Cc-only email.
smtp_to guard
TLDR: if we had duplicate emails in the recipients, it would have caused:
It's fixed by using a list instead of a set. Guards are added.
Explanation:
recipientswas aset()https://github.com/OCA/mail/pull/233/changes#diff-f9cbf73ff985af002f4ecff926acc085c850771dd464b63fa31d8ecbb9fd4470L53-> It removed the duplicates
Then we checked and popped from
self.env.context.get("recipients")=> If we had duplicate emails,
recipientswould run off=> we don't edit the
smtp_to=> Odoo will send a mail for all recipients (To+Cc+Bcc)