#37152: EmailMessage should block `bcc` in `extra_headers` and docs should not
suggest `bcc` is a header
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: diaxoaine
Type: | Status: assigned
Cleanup/optimization |
Component: Core (Mail) | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Mike Edmunds):
* cc: Mike Edmunds (added)
Comment:
Replying to [ticket:37152 Natalia Bidart]:
> 1. Add `bcc` to the `extra_headers` blocklist: `EmailMessage.message()`
already blocks `from`, `to`, `cc`, and `reply-to` from being written into
MIME headers via `extra_headers`, but `bcc` is missing.
Just to clarify, the check for `from`, `to`, `cc`, and `reply-to`
[https://github.com/django/django/blob/867c7c0451f2e67e715da5b55b5bf6696747fdc3/django/core/mail/message.py#L339
in EmailMessage.message()] is to avoid duplicating headers that have
''already been added earlier'' in that method. It's not really meant to be
a general header suppression filter (although I suppose it could be).
This ''might'' need more discussion. It's true that a Bcc header does not
belong in a message being handed off to SMTP, but there are some MTAs
(e.g., `sendmail -t`) that do accept it. So there's a slight chance this
could be a breaking change for some custom EmailBackend. ''Extremely
slight,'' but thought I should mention it. (Also note the opposite request
to ''add'' Bcc headers to serialized messages in the console and file
backends, in #28598.)
--
Ticket URL: <https://code.djangoproject.com/ticket/37152#comment:3>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/0107019eaefd2200-d42f7bd8-13ca-41d2-a744-704f8f95a201-000000%40eu-central-1.amazonses.com.
