• Magdalena Frankiewicz's avatar
    Ignore spoofable Reply-To address in Service Desk · 1be6d168
    Magdalena Frankiewicz authored
    Service Desk allows creating issues by sending an email to a special
    address. Previously, the issue author email was taken from the Reply-To
    email header, if present. The problem is that Reply-To is easily spoofed
    even in common email clients like Gmail. We therefore ignore it, and use
    the From address instead.
    
    Changelog: security
    1be6d168
service_desk_handler.rb 5.64 KB