getRecipients adds the conversation contact to CC when replying to a third party
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 3/5
- Tiempo estimado
- 1-2 días
- Aptitud para principiantes
- 45/100
- Tipo de issue
- Error
- Claridad
- Bastante claro
- Estado de actividad
- Activo
- Stack tecnológico
- typescript
- Área
- frontend
Línea de trabajo
Rastrea getRecipients desde app/javascript/dashboard/components/widgets/conversation/ReplyBox.vue:1263 e inspecciona la rama de destinatarios implicada al responder a un tercero. Compara el comportamiento previsto con #67, #68 y chatwoot/chatwoot#15581; se considera terminado cuando el contacto de la conversación no se añade a CC a menos que fuera destinatario del mensaje al que se responde, sin regresiones en la gestión relacionada de CC.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Describe the bug
When an email conversation contains a message from someone other than the conversation contact, getRecipients adds the conversation contact to the CC list. Replying to that third party therefore copies the original contact in, without the agent choosing it and without an obvious signal.
Call site, unchanged between v4.13.0 and v4.17.1:
// chatwoot/chatwoot, app/javascript/dashboard/components/widgets/conversation/ReplyBox.vue:1263
const { cc, bcc, to } = getRecipients(
this.lastEmail,
conversationContact,
inboxEmail,
forwardToEmail
);
To reproduce
- An email conversation exists with contact A.
- An inbound message arrives on the same thread from B, a different address — a supplier, contractor or colleague who has joined the chain.
- The agent replies to B's message.
- Observe A pre-populated in CC.
Expected behaviour
Recipients for a reply should derive from the message being replied to. The conversation contact should not be added automatically when they were not a party to that message. If the current behaviour is deliberate for some flows, it would be safer as an explicit action the agent takes rather than a default.
Impact
Confidentiality. The realistic case is a contractor or supplier discussing trade pricing or a referral arrangement on a thread the end customer also started. The customer receives a copy. No agent action causes it and nothing draws attention to it, so it can recur for a long time before anyone notices.
We treat this as the highest-severity issue we have found in our deployment.
Related — worth reading before triaging
There is active work in this exact function, and it is the inverse of this bug:
- #67 / #68 here —
getRecipientsdrops incoming To-line recipients from the reply CC. - chatwoot/chatwoot#15581 — the downstream half of that fix.
Those are about recipients wrongly falling out of CC. This report is about a recipient wrongly being put into CC. They touch the same branch, so it is probably worth settling the intended rule for that branch once rather than twice — a fix for one could easily mask or worsen the other.
Environment
Self-hosted Chatwoot v4.13.0, Docker. Behaviour re-checked against the v4.17.1 tag.
Offer
We have run a server-side mitigation in production since 26 August. Happy to work up a PR here, and happy to coordinate with whoever is on #68 so the two do not collide.
- Lenguaje dominante
- TypeScript
- Estrellas
- 11
- Forks
- 14
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Preparar el entorno
Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de chatwoot/utils
-
getRecipients drops incoming email To recipients from the reply CCPosiblemente ocupada @limehawk la tomó hace 89 días. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
Todos los issues de chatwoot/utils
Issues similares
-
twilio.webhook() rejects valid requests when the query string has an encoded `?` and a `+` spaceAbierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
twilio/twilio-node#1232 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 86/100
Los mantenedores suelen responder en 1 día
-
Tiling managers are not destroyed in disable(), so window-created handlers keep running (Gio.Settings constructed without schema)Posiblemente ocupada @gnacho la tomó hoy. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
domferr/tilingshell#641 ·
Los mantenedores suelen responder en 3 días
-
🐛 bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
LibreChat-AI/LibreChat#17887 ·
Los mantenedores suelen responder en 1 día
-
`isCI` is `true` inside a running Google Cloud Run service (also Railway, Render, Deno Deploy)Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 86/100