Out of office: jcoffey-dev is traveling from November 1 to November 6. Responses to issues may be slow or delayed during this time, but I will be checking in.
Scheduling messages received by email were credited to the first From
address whenever the sender was trusted, and a sender who had signed in
to send was trusted whatever the From header said. Sign-in only binds
the envelope sender to the account, so any local user could send an
invitation, reply or cancellation in another person's name and change
the recipient's calendar. The same From address also decided whether a
message marked as spam came from a known contact.
A message from a signed-in sender is now credited to its envelope
sender, which the server already limits to the account's own
addresses. The From header is used only when it passed DMARC, and
otherwise nothing is processed as before.
Test: a signed-in user sending an invitation with another user's From
and organizer added the event to the recipient's calendar on main; now
it is refused and the calendar is unchanged.
jcoffey-dev
1c8c442c46