[3.2][RC] Mail to Post

[david63]

Extension Name: Mail to Post
Author: david63

Description:Adds a feature to receive posts via an email.

Extension Version: [RC] 2.1.0-RC1

Requirements: phpBB 3.2.7

Features:

• Controlled by a new user permission (Can send mail to post)
• User can select which forum their mail messages will be posted in - this can be overridden in ACP
• Mail messages can be retrieved either manually or via a Cron job
• All actions are written to a log file
• Messages can be moderated if required
• Added option to use a PIN when sending the mail new
• Added some basic checks for mail "spoofing" new

Usage:

• An email address is required for sending the posts to - Gmail does work but can be awkward to set up.
• I recommend that a new user group is created with the permission to use this feature into which you can put the users that you want to use it - this makes "troublemakers" easy to remove.

Installation:

• Download the latest release and unzip it.
• Upload the unzipped files to root/ext/david63/mailtopost and enable it in the ACP

GitHub Repository: https://github.com/david63/mailtopost
Extension Download: https://github.com/david63/mailtopost/archive/3.2.zip

[david63]

Reserved

[nou nou]

Very interesting! Subscribed

For clarity, would it be possible to send emails to a specific topic (so it will append a post), or is every email creating a new topic?

(I have not tested the extension yet)

Thanks!

[david63]

would it be possible to send emails to a specific topic (so it will append a post), or is every email creating a new topic?

That is optional. If the subject of a mail message is the same as a topic title in the same forum then it will, at Admin's discretion, be a reply.

[Brf]

So anyone can mail to that mailbox and it creates a post?
Is the post anonymous, or does it post as a user?

[david63]

So anyone can mail to that mailbox and it creates a post?
Is the post anonymous, or does it post as a user?

Yes anyone who knows the mailbox can send a message to it but it will only create a post if a user has been granted permission to post and the email originates from the email registered on the board. Posts will go under the username.

[Brf]

So if your "troublemakers" know the admin's email address they could spoof messages that would be posted as if from that admin.

[david63]

So if your "troublemakers" know the admin's email address they could spoof messages that would be posted as if from that admin.

Possible, but only if the Admin had the permission set. There is also the facility to moderate all messages.

[Brf]

My point was that using Email address alone is not a good way to identify a user, since that Email address can be easily spoofed.

[david63]

My point was that using Email address alone is not a good way to identify a user, since that Email address can be easily spoofed.

I don't totally disagree but there is no other way to get the user information other than imposing a strict format for the mail message that users would get wrong and would be easy for someone to imitate.

I have added a basic "spoofing" check that should trap the casual spoofer.

I still believe that with proper management there are the controls in this extension to capture malicious use - the main one being that you only give the permission to those who you can trust.

[bbthailand]

wow interesting

[DavideBianchini]

This is a HUGE lifesaver, thank you so much for taking the time to write this plugin. I would pay money for this, because it helps us accommodate the needs of some of our members, who are used to posting/replying via email on Yahoo Groups. It is going to make our migration that much more seamless if we can keep our members happy.

Kudos to you,

-Davide

[yooper]

So if your "troublemakers" know the admin's email address they could spoof messages that would be posted as if from that admin.

Actually, that is how Yahoo Groups functioned for @ 20 years now.. but: #1 - very few people know that, and; #2 - most Yahoo forums don't display the email addresses of their members (display is an admin option). In the 15 years I've run groups on Yahoo I've never seen that "vulnerability" exploited.

That said, there are numerous ways to ID and thwart "troublemakers" if they appear, particularly if you're running your own server.

[david63]

Updated to version 2.1.0-RC1

Added some checks to try and prevent mail "spoofing"

Added option to use a PIN when sending the mail message. The PIN is set by each user and is six characters (any character) and must be the first six characters of the mail message. The PIN is stripped off (if it is correct) before the mail message is posted to the board.

To update:

• Disable extension
• Delete data for the extension
• Delete the files
• Upload new files
• Enable extension
• Configure extension settings and reapply the permission

[DavideBianchini]

Added option to use a PIN when sending the mail message. The PIN is set by each user and is six characters (any character) and must be the first six characters of the mail message. The PIN is stripped off (if it is correct) before the mail message is posted to the board.

Nice, clever idea.

-Davide