Can not register for commento account

[privsec]

Hello,

I have uninstalled and reinstalled the commento app twice while attempting to register an account.

There is nothing in the logs for the app, but in the email I have

{
"ts": 1639897611952,
"type": "bounce",
"direction": "outbound",
"uuid": "B7478F41-A5EB-4797-ADC1-9A37C1774AFB.1.1",
"messageId": null,
"mailFrom": "commento.app@domain.com",
"spamStatus": null,
"rcptTo": [
"commento@domain.com"
],
"message": "551 5.7.1 Multiple addresses in a From header is not allowed",
"mx": {
"priority": 0,
"exchange": "smtp.emaildomain.com",
"port": 587,
"auth_type": "plain",
"auth_user": "user@domain.com",
"auth_pass": "smtppasscode",
"family": "A",
"bind_helo": "my.domain.com"
}
}

Any ideas on this?

[jdaviescoates]

@privsec why have you posted this in the Roundcube category?

[privsec]

@jdaviescoates
I was under the impression that cloudron uses roundcube to send outbound mail.

[jdaviescoates]

@privsec nah, Roundcube is just one of the webmail client options.

The email server stuff is Haraka (and maybe Dovecot too, I think).

[girish]

@privsec said in Can not register for commento account:

551 5.7.1 Multiple addresses in a From header is not allowed

The above seems to be the issue.. but I can reproduce it though. Does your email address have any special characters (like say '+' , '-' ) ? Are you using a relay ?

[girish]

@girish said in Can not register for commento account:

551 5.7.1 Multiple addresses in a From header is not allowed

I cannot find this string in the Haraka code base atleast, so maybe it's coming from the relay you are using?

[oneleaftea]

I have the same problem, and the fundamental reason, I believe is that emails don't work for Commento with the SMTP relay I am using (Amazon SES). I can't use SMTP directly due to unavailable outbound port.

My workaround (for registration only!) is to enable the email on the Cloudron server and set a catchall.

When you register for Commento, it won't work, but you will get an undeliverable message sent from commento.app@yourdomain.com. And then you will receive the bounce message at your catchall. Then you can register.

However, admin/moderator emails will not work after that... but at least you can register and get it to work. But after that, no notification emails will work. I wonder if there is a fix for this? Looking at the log, I see the following:

"554 Transaction failed: Missing '<'"

[oneleaftea]

@girish
So I tested it with Amazon SES relay and then with a different SMTP server (PurelyMail's). It works with PurelyMail's but not with Amazon SES. The error message refers to the '<' character.

So now, looking at emails sent to me using the working SMTP server, I am noticing that Commento's app does something different with the headers:

Here's a typical test email header sent from the Cloudron email settings page:

From: Cloudron <no-reply@mydomain.com>
To: me@mydomain.com

Here's one sent from Commento's app. Note that this is the one that I received via PurelyMail's SMTP server. This would have failed with Amazon SES:

From: Commento <<commento.app@mydomain.com>>
To: Joe Smith <<me@mydomain.com>>

I swapped out the domain to mydomain.com. But notice that Commento has the extra brackets, and whereas PurelyMail's SMTP server handles it fine, Amazon SES chokes on it. Is this something in Cloudron's implementation of Commento that adds this?

Thanks for taking a look!

[girish]

@oneleaftea said in Can not register for commento account:

From: Commento <<commento.app@mydomain.com>>
To: Joe Smith <<me@mydomain.com>>

I swapped out the domain to mydomain.com. But notice that Commento has the extra brackets, and whereas PurelyMail's SMTP server handles it fine, Amazon SES chokes on it. Is this something in Cloudron's implementation of Commento that adds this?

The double bracket comes from the app. Unfortunately, the app itself is not actively maintained, making this hard to fix.

[oneleaftea]

@girish Thanks for the update on this! I just updated to the latest Commento++, and tested the Amazon SES credentials and it continued to fail on outbound email notifications. PurelyMail's SMTP still works. Do you think this would be able to be addressed with Commento++, being this one is actively managed? Thanks again!

EDIT: The double bracket problem listed above still occurs. I did notice if i bring it in Gmail, it has a slightly different output in the header.

As before, in Roundcube:

From: Commento <<commento.app@mydomain.com>>
To: My Name <<me@mydomain.com>>

And then if I pick up the email in Gmail, the headers show like this:

From: "Commento <>" <commento.app@mydomain.com>
To: "My Name <>" <me@mydomain.com>

[oneleaftea]

Ah, I just saw the new commits on the commento++ repository and it looks like they have fixed it. The previous file smtp_send.go seemed to add the brackets and cause issues, but the new formatting is simplified and should work.

I assume there is no easy way to bring in these changes to my Cloudron instance beyond simply waiting for the next update?

Thanks!

[girish]

@oneleaftea do you have a link to the commit/change ?

[oneleaftea]

@girish
Yep, there have been a number of commits on it in the past 2 months, but this one is the one that changed the header "From" field:

https://github.com/souramoo/commentoplusplus/commit/81ff377f419c9bb853418e76fe9754bea1ad8101

I'm not sure this would fix it, but previously, the code had this:

headers["From"] = "Commento <" + from.String() + ">"

Which led to our FROM address populating like

Commento <<cloudron.app@ourdomain.com>>

And the code removes that portion in the latest commits.

Do you think the changes would fix this issue? I also wasn't sure if something about Cloudron input the email address with the brackets when the Commento app does not expect it (hence why it adds it), leading to the double brackets. I don't have a non-Cloudron installation of Commento to know for sure.

Thanks again!

[girish]

@oneleaftea Yes, looks like that will fix the issue. Do you know when they make the next release? Currently, the package does not build from source but uses upstream releases.

[oneleaftea]

@girish
Unfortunately, I don't know how to find out... but I'll keep an eye on it and update when I find out! Thanks!