https://bugs.kde.org/show_bug.cgi?id=356865

--- Comment #2 from Jan Kundrát <j...@kde.org> ---
> In this function, the
> Bcc header is not included (as is appropriate for the version 
> of the mail that is sent out).

Yeah, it seems that some MTAs out there (Exim is an example, [1]) do not 
strip out the Bcc headers during submission through ESMTP. Because Trojita 
tries to save bandwidth (see our support for BURL, CATENATE etc), there's a 
big value in only having to upload just one instance of an outgoing 
message.

It would be very easy to write out Bcc into the sent folder, but then we 
have to ensure that the Bcc is not leaked to the actual outgoing message. 
This is doable by, e.g., employing chunked message submission, where the 
composer remembers which part of the header contains this privacy-sensitive 
data, and white outs their content.

Here's how to do it:

1) Generate the plaintext of the message, place the Bcc header into a 
well-known place (end of all headers sounds like a trivial fix, if it's 
legal),
2) Remember the offsets of the beginning and end of this sensitive area,
3) Change the code to not treat the just-saved message as a single entity, 
but rather as a pair of (stuff before the whitened-out, stuff after), and 
pass this pair to BURL.

[1] http://marc.info/?l=mutt-dev&m=112930534206625

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to