From 2445f9e3c22db810d61996afde883e4ca608f15b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20BEAU?= Date: Tue, 2 Jan 2018 12:28:58 +0100 Subject: [PATCH] [FIX] base: remove BCC header from outgoing emails to avoid leaking information When sending emails SMTP server only requires an author, recipients and the email to send. It does not make any modification of what is sent. It is therefore possible that BCC content is sent. BCC mean 'Blind Carbon Copy', the address in this field should be not send in the header of the mail and must be removed, if not the address are visible for all recipients. Closes #21965 . --- odoo/addons/base/ir/ir_mail_server.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/odoo/addons/base/ir/ir_mail_server.py b/odoo/addons/base/ir/ir_mail_server.py index 6bb287ca69b..2e936a74579 100644 --- a/odoo/addons/base/ir/ir_mail_server.py +++ b/odoo/addons/base/ir/ir_mail_server.py @@ -192,7 +192,7 @@ class IrMailServer(models.Model): """Returns a new SMTP connection to the give SMTP server, authenticated with ``user`` and ``password`` if provided, and encrypted as requested by the ``encryption`` parameter. - + :param host: host or IP of SMTP server to connect to :param int port: SMTP port to connect to :param user: optional username to authenticate with @@ -397,6 +397,7 @@ class IrMailServer(models.Model): email_to = message['To'] email_cc = message['Cc'] email_bcc = message['Bcc'] + del message['Bcc'] smtp_to_list = filter(None, tools.flatten(map(extract_rfc2822_addresses, [email_to, email_cc, email_bcc]))) assert smtp_to_list, self.NO_VALID_RECIPIENT