Tickets :: Comment on [#11376] Itip auto-accept requests

* Your Email Address
* Spam protection	Enter the letters below: ..__. __ .__..__ \|\| \|/ `\| \|\| \ \__\|\|__\\__.\|__\|\|__/
Comment	>> Sure. An attacker needs to at least know the information that an >> event exists and the details of the event, so that rules out random >> auto-sent e-mails from being a concern. >> >> But within a user's group of contacts (especially if an event has >> many potential attendees), this information is not difficult to >> obtain. So it's not a tremendously difficult attack either. > > That depends. Within an organization (for "local" addresses) it is > trivial to prevent users from forging sender addresses. In that case > there is no attack vector, since people will not be able to forge > replies. But this is only the case for addresses we know are local, > replies from external (non-local) users should probably never be > auto-accepted. At the very least, there should be an option to treat > local and non-local users differently.
Attachment
Watch this ticket