mail
mail copied to clipboard
nextcloud
Restrict sending emails to specific groups
The autocompleting feature for sending to nextcloud groups https://github.com/nextcloud/mail/pull/810 is absolutely great! But to avoid unwanted spamming there should be some restriction options.
In the Settings -> Sharing section the option "Restrict users to only share with users in their groups" restricts sharing to own groups only. In our case we want to enable the users to share files with other groups (so disable this option), but they should not be able to mail to users in other groups. Even if this option is ticked we need more restriction. E.g. we use the "Everyone Group" https://github.com/icewind1991/group_everyone because we need some global file sharing for all users. Sending mails to this group (= all users) should be permitted completely or allowed to admins and/or group admins only. (There's an request to restrict all sharing for this specific group to admins only https://github.com/icewind1991/group_everyone/issues/11 but in our case we do need the file sharing, only disable mails and chat.)
Background: We are a school with teachers, students, parents, office and so on (will be about 1.000 users). We have content that should be available for everyone like downloadable files, school calendars... But in no way everyone should be able to send mails to all 1.000 users. As groups we have classes, teachers with subgroups, working groups. For some working groups it makes sense to get mails from anybody, but for most groups, classes and teachers not. File sharing between groups is needed.
My suggestion would be an option in the Settings -> Sharing section "Restrict sending emails to groups (exclude groups)" and/or "Restrict sending emails to groups (include groups)", working like the "Exclude groups from sharing" option where groups can be selected.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
The Talk app solved this with a "Limit to groups" option on it's own settings page, introduced in https://github.com/nextcloud/spreed/pull/1585 If at least one group is included per this option, all other groups are not callable. Maybe the mail app could use a similar approach.
Is there any news on this feature? The fact that the mail plugin makes all groups visible for every user is a major privacy/security problem on our server (not everyone is supposed to even know about which groups are using the nextcloud instance) and prevents us from using it at all.
Is there any news on this feature? It would be excellent if there was a restriction so that contact suggestions were restricted by group(s) to which each user belongs.
It seems that a easy/incomplete fix has been implemented. I'm curious to try it out but just hadn't the time to set up a testing environment for this, yet.
Has maybe someone else already tested it already?