Fix matching of incoming email addresses to the alternate_addresses

field of a user -- this would match substrings, e.g. if the user has
discuss-support@example.com as an alternate email and an incoming mail
is addressed to support@example.com this would (wrongly) match.

Note: I *think* I've seen this discussed somewhere but couldn't find it,
neither in the tracker nor in recent discussions on the mailinglists.
So if someone remembers an issue which now should be closed, please
tell me :-)

git-svn-id: http://svn.roundup-tracker.org/svnroot/roundup/roundup/trunk@4644 57a73879-2fb5-44c3-a270-3262357dd7e2

diff --git a/CHANGES.txt b/CHANGES.txt
index 185d13216fc742978a31c1e4d8acfd73a632c27d..2aac40e42bb37a032f60756b1152d9b28673a990 100644 (file)
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -8,12 +8,15 @@ Entries without name were done by Richard Jones.
 Features:
 Fixed:
 
-issue2550715: IndexError when requesting non-existing file via http.
+- issue2550715: IndexError when requesting non-existing file via http.
   Reported and fixed by Cédric Krier. (Bernhard)
-
-issue2550695: 'No sort or group' settings not retained when editing queries.
+- issue2550695: 'No sort or group' settings not retained when editing queries.
   Reported and fixed by John Kristensen. Tested by Satchidanand Haridas. 
   (Bernhard)
+- Fix matching of incoming email addresses to the alternate_addresses
+  field of a user -- this would match substrings, e.g. if the user has
+  discuss-support@example.com as an alternate email and an incoming mail
+  is addressed to support@example.com this would (wrongly) match. (Ralf)
 
 2011-07-15 1.4.19 (r4638)
 

diff --git a/roundup/mailgw.py b/roundup/mailgw.py
index 2da86bb01decaf7754d9938726f63f17b6b89f48..7a71d6a7017dc9e90705ec7b0c0335d600342696 100644 (file)
--- a/roundup/mailgw.py
+++ b/roundup/mailgw.py
@@ -1666,7 +1666,17 @@ def uidFromAddress(db, address, create=1, **user_props):
     props = db.user.getprops()
     if props.has_key('alternate_addresses'):
         users = db.user.filter(None, {'alternate_addresses': address})
-        user = extractUserFromList(db.user, users)
+        # We want an exact match of the email, not just a substring
+        # match. Otherwise e.g. support@example.com would match
+        # discuss-support@example.com which is not what we want.
+        found_users = []
+        for u in users:
+            alt = db.user.get(u, 'alternate_addresses').split('\n')
+            for a in alt:
+                if a.strip().lower() == address.lower():
+                    found_users.append(u)
+                    break
+        user = extractUserFromList(db.user, found_users)
         if user is not None:
             return user
 

diff --git a/test/test_mailgw.py b/test/test_mailgw.py
index 0cd78d486ac1e41e849dc649a093847239827679..6b64a30caae047aa1bfa85d54617ea632f614726 100644 (file)
--- a/test/test_mailgw.py
+++ b/test/test_mailgw.py
@@ -2205,6 +2205,12 @@ This is a followup
         self.assertEqual(uidFromAddress(self.db, ('', 'user1@bar.com'), 0), i)
         self.assertEqual(uidFromAddress(self.db, ('', 'USER1@bar.com'), 0), i)
 
+    def testUserAlternateSubstringNomatch(self):
+        i = self.db.user.create(username='user1', address='user1@foo.com',
+                                alternate_addresses='x-user1@bar.com')
+        self.assertEqual(uidFromAddress(self.db, ('', 'user1@bar.com'), 0), 0)
+        self.assertEqual(uidFromAddress(self.db, ('', 'USER1@bar.com'), 0), 0)
+
     def testUserCreate(self):
         i = uidFromAddress(self.db, ('', 'user@foo.com'), 1)
         self.assertNotEqual(uidFromAddress(self.db, ('', 'user@bar.com'), 1), i)