Page MenuHomeMiraheze

Review MiniInvite
Closed, DeclinedPublic

Event Timeline

@Arcane21 Extension:MiniInvite is declined for security reasons. In particular, you can email to arbitrary users with arbitrary subjects and text, and they will appear to come from Miraheze. I don't even think setting $wgEmailFrom would help, unless you want it to be donttrustthisemail@miraheze.org. And even then we're an open spam server with a weird API.

https://github.com/wikimedia/mediawiki-extensions-MiniInvite/blob/master/SpecialInviteEmail.php#L47 lines 47-63 are the blocker.

Yeesh, that is a bad thing.

Thanks for declining this, don't want to make Miraheze look like spammers.