This has been implemented in IMP H3 (4.0 RC2).

Fixed the bug in a slightly different way, which is much more robust - 
your way of splitting isn't RFC822 compliant since it may split in the 
middle of the name part of the email address (i.e. '"Bar, Foo" 
<foobar@example.com>' would be split to '"Bar' and ' Foo" 
<foobar@example.com'.  Additionally, compose.php does not recognize a 
semicolon as a valid delimiter (as stated in the help window).

Thanks for the quick responses.



imp/compose.php now needs this for multiple recipients to work. 
Without it, $recipientArray[0] still contains the entire "to" list, 
$recipientArray[1] the entire "cc" list, etc.



Index: imp/compose.php

===================================================================

RCS file: /repository/imp/compose.php,v

retrieving revision 2.791

diff -u -r2.791 compose.php

--- imp/compose.php     24 Nov 2004 07:51:24 -0000      2.791

+++ imp/compose.php     24 Nov 2004 12:29:04 -0000

@@ -772,6 +772,7 @@

          break;

      }

      $recipients = implode(', ', $recipientArray);

+    $recipientArray = split("[,;]", $recipients);



      /* Get identity information now as it is needed for some of the 
encryption

       * code. */

Just committed code to allow us to do the things I mentioned 
previously.  Hopefully this will fix this bug - let me know if there 
are any problems.

Then again, the more I think about this the more I think we need to 
implement this.  Retricting a user to one recipient when sending an 
encrypted message, and not allowing the user to be able to decrypt the 
sent message, is an awfully big limitation...

I'm going to hold off on this until after 4.0 released.  This would 
touch too much code that currently works fine this late in the release 
cycle.



I have already fixed the S/MIME/public key error checking code.

I found that the imp/compose.php S/MIME encryption was not doing 
error-checking for, e.g., not having recipient's public key.



The attached patches that in addition to the previous comment's.

This patch rearranges the send_message actionID handling to accomplish that.



It works for me, but is not fully tested.

While you're at it please look into this enhancement.



Currently imp/compose.php can only encrypt for one recipient. Also, 
the saved message is encrypted for that same recipient, meaning the 
sender cannot read it.



Suggestion is to target encryption to each recipient, as well as 
target the saved message for the sender. Fail if any of the encryption 
fails, which is a reasonable response.