704992 - Refund request emails are coming from the user requesting

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect, P1)

Description

[Wil Clouser [:clouserw]]

Refund request emails' have their From set as the user requesting the refund (I think).  The From should be something other than that, either [e-mail] or [e-mail].  Fligtar - which do you want?

Comment 1

[Andy McKay]

While you are there, the emails are sent from settings.FLIGTAR. Let's change that to settings.MARKETPLACE_EMAIL.

Comment 2

[Justin Scott [:fligtar]]

We shouldn't reveal users' email addresses for refunds and I don't think emails should come from an address that isn't going to be monitored (and that will get thousands of email bounces when our emails fail).

Why can't we use [e-mail]?

Comment 3

[Andy McKay]

Just to check the support flow asks allows the person to contact the developer. In that case I think the email address (or at least reply to) has to be the users email address.

http://people.mozilla.com/~fligtar/marketplace/Support%20Flow.png

Comment 4

[Allen Short [:ashort]]

fligtar, is this how we oughta handle the issue?

https://github.com/washort/zamboni/commit/a7d536f6ff0fcc065d1acf58621f1121292619bc

Comment 5

[Justin Scott [:fligtar]]

(In reply to Andy McKay [:andym] from comment #3)
> Just to check the support flow asks allows the person to contact the
> developer. In that case I think the email address (or at least reply to) has
> to be the users email address.
> 
> http://people.mozilla.com/~fligtar/marketplace/Support%20Flow.png

Yes, it's reasonable in the support case as a user requesting support expects to get a reply.

Comment 6

[Justin Scott [:fligtar]]

(In reply to Allen Short [:ashort] from comment #4)
> fligtar, is this how we oughta handle the issue?
> 
> https://github.com/washort/zamboni/commit/
> a7d536f6ff0fcc065d1acf58621f1121292619bc

I don't know what that code does but it sounds like it still exposes the user's email for refunds. Would rather we not expose it at all for that.

Comment 7

[Christopher Van Wiemeersch [:cvan]]

The Reply-To header of the message is still the user's email. Should that be removed altogether?

Comment 8

[Allen Short [:ashort]]

reply-to removed.
https://github.com/mozilla/zamboni/commit/58b343baa618159dd7fbfdb4545a0ec119011d40