RT AutoCreated Watcher From: header causing bounces

RT Users
4

Looking at the code to see if I can find out what causes this. I think what is happening:

  • On the first reply to a (non-email created) ticket, watchers created from replies to tickets (i.e. where we send an outbound ticket, and a reply comes in from a previously unknown email address), are apparently created by RT::Interface::Email::Auth::MailFrom, and have the comment Autocreated on ticket submission added to the user profile. The Real Name field in this case is correctly populated by LoadOrCreateByEmail:
    my $user = RT::User->new( RT->SystemUser );
    $user->LoadOrCreateByEmail(
        RealName     => $Name,
        EmailAddress => $Address,
        Comments     => 'Autocreated on ticket submission',
    );

    $CurrentUser = RT::CurrentUser->new;
    $CurrentUser->Load( $user->id );

    return $CurrentUser;
  • Other auto-created users have this comment: Autocreated when added as a watcher. This seems to be what happens when LoadOrCreateByEmail is called only with email address.
sub LoadOrCreateByEmail {
    my $self = shift;

    my %create;
    if (@_ > 1) {
        %create = (@_);
    } elsif ( UNIVERSAL::isa( $_[0] => 'Email::Address' ) ) {
        @create{'EmailAddress','RealName'} = ($_[0]->address, $_[0]->phrase);
    } else {
        my ($addr) = RT::EmailParser->ParseEmailAddress( $_[0] );
        @create{'EmailAddress','RealName'} = $addr ? ($addr->address, $addr->phrase) : (undef, undef);
    }

Looks like if it doesn’t get a RealName, it sets RealName to $addr. This is probably not a safe thing to do these days given the anti-spoofing policies of many mail providers, who want to prevent phishing attempts with headers that look like:

From: "The Boss - boss@yourcompany.com" <evil@scumbag.scammer.com>

Many email clients by default only display the name part and hide the actual From: address, so you end up with:

From: The Boss - boss@yourcompany.com

(Although it may display a warning that this is from an external sender, I guess users just get blind to this warning after a while.)

  • We use a modified version of this scrip: AddWatchersOnCorrespond - Request Tracker Wiki. Because internal users like to follow-up using email, we need to ensure that if the customer adds a Cc: or To:, they are automatically added as a Requestor to the ticket. (The person corresponding via email will not realise that their replies are not going to the people added in Cc: by the customer.)

  • AddWatchersOnCorrespond was calling LoadOrCreateByEmai() only with the email address, not attempting to populate RealName. I have updated AddWatchersOnCorrespond so it now always populates the RealName field for users it autocreates. (If there is no phrase to be found in the header, it makes something up based on the local-part of the email address, e.g. “fred.bloggs@example.com” will become "Fred Bloggs".

  • (After this executes, We also use RT-Extension-NonWatcherRecipients to add a warning into the Admins email notification of any recipients on the email that are not on the ticket. (Our version of AddWatchersOnCorrespond checks if the proposed cc/to to be added is from a domain of a watcher already on the ticket and if not, does not add them.))