Describe the issue
The announcement tool in the secr app accepts messages whose addressee fields (To / Cc) contain badly formatted address lists. When send_smtp() is called to deliver the message, it passes these through email.utils.getaddresses() to validate and parse them. When an invalid address is present, that method returns [("", "")] which is treated as an empty addressee list. This causes datatracker to log a message that no message was sent, but no other feedback is made. No feedback at all is available to the user except that their message is not delivered.
This comes up, e.g., if the user mistakenly uses ; rather than , to separate otherwise valid email addresses.
These form fields should be validated using the same (or equivalent) logic as send_smtp() so that messages will not be accepted if they will not be sent.
Code of Conduct
Describe the issue
The announcement tool in the secr app accepts messages whose addressee fields (To / Cc) contain badly formatted address lists. When
send_smtp()is called to deliver the message, it passes these throughemail.utils.getaddresses()to validate and parse them. When an invalid address is present, that method returns[("", "")]which is treated as an empty addressee list. This causes datatracker to log a message that no message was sent, but no other feedback is made. No feedback at all is available to the user except that their message is not delivered.This comes up, e.g., if the user mistakenly uses
;rather than,to separate otherwise valid email addresses.These form fields should be validated using the same (or equivalent) logic as
send_smtp()so that messages will not be accepted if they will not be sent.Code of Conduct