Download & Extend

Force Bcc field to avoid unwanted address disclosure

Project:Mass Contact
Version:5.x-2.x-dev
Component:Code
Category:feature request
Priority:normal
Assigned:oadaeh
Status:closed (fixed)

Issue Summary

It would be nice to have a way of forcing the Bcc field, so that e-mail adresses are not inadvertently disclosed. Thank you.

Comments

#1

Status:active» fixed

This is an existing optional admin setting.

#2

yes, however the users delegated to send mass e-mail can override (unset) the Bcc flag,
therefore disclosing the e-mail addresses of many users to would-be spammers. What I
meant was for the root admin to have total control over this flag, really forcing
the Bcc. Thank you.

#3

Version:5.x-1.5» 5.x-2.x-dev
Assigned to:Anonymous» oadaeh
Status:fixed» active

Okay. I'll look at this after the bugs are fixed.

#4

Status:active» fixed

This has been submitted to the 5.x-2.x CVS source tree (not 5.x-2.0): http://drupal.org/cvs?commit=76389

Let me know if the implementation is acceptable to you.

I will cut a new release after I've added a few new features.

#5

I just upgraded to 5.x-2.x-dev and it works as expected.
I was wondering whether additional parameters "send as HTML" should be handled as BCC (i.e.: allow override option),
and whether "save a copy as a node" should be configurable only by sysadmin. What is your feeling about it?
On a side note: I keep looking for mass_contact settings in "Site configuration", but it resides in "Site building".
Not a big issue, though.
Again, thank you!

note: I got the following errors when trying to estract mass_contact.pot via potx
* Invalid marker content in mass_contact.module:625 * t(token_replace(variable_get('mass_contact_message_prefix','')))
* Invalid marker content in mass_contact.module:628 * t(variable_get('mass_contact_message_prefix',''))
* Invalid marker content in mass_contact.module:646 * t(token_replace(variable_get('mass_contact_message_suffix','')))
* Invalid marker content in mass_contact.module:649 * t(variable_get('mass_contact_message_suffix',''))
* Invalid marker content in mass_contact.module:738 * t($form_values['subject'])

#6

> I was wondering whether additional parameters "send as HTML" should be handled as BCC (i.e.: allow override option),

I'm open to that. It certainly wasn't difficult doing it with BCC.

> and whether "save a copy as a node" should be configurable only by sysadmin. What is your feeling about it?

I'm not sure about that one. It could certainly be treated as BCC, but I think I'd prefer to give the admin the choice, rather than choosing for them.

> On a side note: I keep looking for mass_contact settings in "Site configuration", but it resides in "Site building".

I do, too. I didn't put it there, the original author did, and I believe it was because he was following the example of the Contact module, which also puts the settings menu under "Site building". For now, I'm choosing to keep with that mode, but if there's enough of an outcry, I can certainly move it.

> note: I got the following errors when trying to estract mass_contact.pot via potx

I wasn't sure if that would work or not. I guess I'll have to remove the t() in those areas (or figure out a better way).

#7

Re "save a copy as a node": my Mass Contact users
know nothing about Drupal, so they keep asking:
- what does "as a node" means?
- where is the saved copy of my message?

#8

Status:fixed» closed (fixed)

#9

Status:closed (fixed)» active

I didn't want this to get forgotten.

#10

Status:active» fixed

This has finally been done for HEAD, DRUPAL-6--1 and DRUPAL-5--2.

#11

Thank you!

#12

Status:fixed» closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.