193989 - Email notification for cancellation of "password change token" does not use emailsuffix

Status: RESOLVED FIXED

(Bugzilla :: Email Notifications, defect)

Description

[Jeff Lawson]

The "emailsuffix" parameter setting is not taken into account when sending an 
email notification to the user when the "password change token" is cancelled.  
All other email notifications relating to tokens seem to be handled properly 
except the cancellation message.

Comment 1

[Jeff Lawson]

Attachment: patch to Token.pm to handle emailsuffix parameter

Fixes the problem by including the suffix.  I removed the incorporation of the
user's "full name" in the "To:" address, since that seemed inconsistent with
all other instances in this file.

Comment 2

[J. Paul Reed [:preed]]

Why are we chopping out $realname now?

Comment 3

[Jeff Lawson]

Including the realname would be inconsistent with how emails are formed for all 
other bugzilla notifications and was failing for us (apparently due to improper 
escaping?).  The realname is not really essential for mail delivery, but it is 
worse for it to be inconsistently used in some places.  If you guys really want 
to include it on all emails in the future, then it should probably be ensured 
that all emails include it for all addresses (to and cc), but that probably 
needs to be another bug.

Comment 4

[J. Paul Reed [:preed]]

Hrm... ok. Makes sense to me. The to include/not to include realname issue will
go away when emails are templatized; each site can make a decision then.

I'll test this patch on my test installation ASAP.

Comment 5

[Jeff Lawson]

I think our problem was that some of our realnames include commas
(ie: $realname = "lastname, firstname") so that was being interpreted as 
two "To:" recipients.  Dealing with other special characters in the realname 
would also need to be handled before it can be arbitrarily included (such as 
$realname's that actually contain quote characters and maybe other high-ASCII 
chars?).  As I suggested, including the realname in a consistent and safe 
manner would need to be addressed universally in some other bug if that is 
really what's desired.

Comment 6

[Dave Miller [:justdave]]

Comment on attachment 114870 [details] [diff] [review]
patch to Token.pm to handle emailsuffix parameter

looks good to me.

Yeah, including the real name without escaping it for proper To: header syntax
could be considered a security hole.  Good thing to remove it at this point
since it's not being escaped properly.

Comment 7

[Dave Miller [:justdave]]

-> patch author

Comment 8

[Dave Miller [:justdave]]

Checking in Token.pm;
/cvsroot/mozilla/webtools/bugzilla/Token.pm,v  <--  Token.pm
new revision: 1.17; previous revision: 1.16
done