You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, the mail filter works as intended - it filters using regular expressions and it does it well. However, users may sometimes try to evade blacklists because the extension correctly assumes that the pattern written in some casing corresponds exactly to that casing when validations. This is a fine assumption but might not be ideal because Flarum already considers e-mails case-insensitive, meaning something like [email protected] is the same as [email protected]. The extension, however, doesn't assume this, and if you have a deleted users and a blacklist filter in place, they can bypass it by changing the filter.
For whitelisting purposes, this is fine, because users can just type in a correct mail and that is that. However, for blacklisting purposes, it might be smarter to enable at least a flag which enables case insensitive matching - meaning that before mail validation, if such flag is set, the email to be checked is lowercased before the check is ran.
Currently it seems to me that the only way is to manually specify that it is case insensitive with a pattern like [Aa][Bb]12345\@mail\.com$, but it would probably be better if you could apply this to exact blacklists and whitelists (non-pattern ones) to save on processing time and make the process a bit more straightforward and noob-proof.
The text was updated successfully, but these errors were encountered:
Sorry for getting back to you late, was caught up with all my schoolwork.
Thank you, this is a very valid point. Please checkout version 1.0.6, it should now be case insensitive on blacklists.
Currently, the mail filter works as intended - it filters using regular expressions and it does it well. However, users may sometimes try to evade blacklists because the extension correctly assumes that the pattern written in some casing corresponds exactly to that casing when validations. This is a fine assumption but might not be ideal because Flarum already considers e-mails case-insensitive, meaning something like
[email protected]
is the same as[email protected]
. The extension, however, doesn't assume this, and if you have a deleted users and a blacklist filter in place, they can bypass it by changing the filter.For whitelisting purposes, this is fine, because users can just type in a correct mail and that is that. However, for blacklisting purposes, it might be smarter to enable at least a flag which enables case insensitive matching - meaning that before mail validation, if such flag is set, the email to be checked is lowercased before the check is ran.
Currently it seems to me that the only way is to manually specify that it is case insensitive with a pattern like
[Aa][Bb]12345\@mail\.com$
, but it would probably be better if you could apply this to exact blacklists and whitelists (non-pattern ones) to save on processing time and make the process a bit more straightforward and noob-proof.The text was updated successfully, but these errors were encountered: