sieve vacation using from: not reply-to:

Heiner

2/27/24, 4:48 PM

Sieve vacation answers fine, but uses the from: field but not the reply-to: field, which would make much more sense (to me).

Using sieve with roundcube, sieve script is

require ["vacation"];
# rule:[rep]
if header :contains "subject" "Software"
{
    vacation :subject "reply!!" "abc";
}

How do i hint sieve to answer to reply-to?

189

2 + 1

sieve

anx

2/27/24, 5:17 PM

What sort of validation are you doing on the contents of that field? The answer is usually "even less than we do on the return path", which would result in potential for using your server to sling trash into attacker-specified directions.

Score:0

Server

anx

2/27/24, 5:14 PM

Don't. Whatever remains of legitimate uses of the "reply-to" field only survives as long as it is not conflated with the return address.

RFC3834 gives some recommendations in its section appropriately named section 4. "The Where to send automatic responses (and where not to send them)", e.g.:

Reply-To [..] In general, this field is set by a human sender based on his/her anticipation of how human recipients will respond to the specific content of that message.

Towards certain recipients I even deliberately use that field only to be able to clarify in the from header where they can stick useless machine chatter, in cases where the only response I am interested in is one that unambiguously clarifies that an identifiable human has accepted legal responsibility for the matter.

+ 4

Heiner

2/27/24, 5:18 PM

Yes, thank you .. well i did not invent the problem. The problem comes from a webform, and that webform sends after filling the form with the from field set to 'the_web_form_admin' and with the user email inserted into the reply-to field. i am a bit stuck in that.

anx

2/27/24, 5:23 PM

@Heiner Then maybe the problem you want to solve is less "How to make sieve do things it should not?" and more "How to add a BCC recipient to this webform?"

Heiner

2/27/24, 8:20 PM

Yes, well .. i think i have to pipe the mail into a script and continue there, that is much more flexible. About the reply-to: the guys developing the webform say, in fact it is the webserver sending the mail, not the person using it. So changing a from: field is mail spoofing. Also true. How/why would a bcc field help?

anx

2/27/24, 9:16 PM

You appear to wish to send a message `From:` your address to the address (possibly but not necessarily mentioned in the headers) you put into the `Reply-To:` right now. Instead of the web server sending the message your way, and you replying.. you could have it carbon copy to intended recipient right away.

Score:0

Server

Heiner

2/28/24, 3:15 PM

I solved it by matching the header, capturing and setting a variable and sending a notification to reply-to this way:

require ["variables","enotify"];
# rule:[set]
if true {
    if allof(header :matches "reply-to" "*", not header :is "from" "${1}")
    {
        set "message" "message body text";
        notify  :importance "1"
                :from "[email protected]"
                :message "this is the subject line"
                "mailto:${1}?subject=SIEVE&body=${message}";

    }
}

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: sieve vacation using from: not reply-to:

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.