Redmine

+1
This feature can prevent potential information leakage.

If an employee has changed the email address of their Redmine account from the organization's email address to their personal email address, notifications are delivered to their home. It is problematic for some organizations.

We can avoid or reduce the problem if Redmine has "Allowed email domains" and "Disallowed email domains" settings that limit email addresses that can be set for accounts. For attachments, we already have similar settings "Allowed extensions" and "Disallowed extensions" (#20008).

Go MAEDA wrote:

We can avoid or reduce the problem if Redmine has "Allowed email domains" and "Disallowed email domains" settings that limit email addresses that can be set for accounts. For attachments, we already have similar settings "Allowed extensions" and "Disallowed extensions" (#20008).

Added settings for "Allowed email domains" and "Disallowed email domains" to "Administration > Settings > Users".

I created a patch that restricts domains.

diff --git a/app/models/email_address.rb b/app/models/email_address.rb
index 4cd9c5dfd..85b77fc3a 100644
--- a/app/models/email_address.rb
+++ b/app/models/email_address.rb
@@ -36,6 +36,7 @@ class EmailAddress < ActiveRecord::Base
   validates_length_of :address, :maximum => User::MAIL_LENGTH_LIMIT, :allow_nil => true
   validates_uniqueness_of :address, :case_sensitive => false,
     :if => Proc.new {|email| email.address_changed? && email.address.present?}
+  validate :validate_domain, :if => Proc.new{|email| email.errors[:address].blank? && email.address.present?}

   safe_attributes 'address'

@@ -117,4 +118,29 @@ class EmailAddress < ActiveRecord::Base
       Token.where(:user_id => user_id, :action => tokens).delete_all
     end
   end
+
+  def validate_domain
+    denied, allowed =
+      [:email_domains_denied, :email_domains_allowed].map do |setting|
+        Setting.__send__(setting)
+      end
+    invalid = false
+    domain = address.sub(/\A.*@/, '')
+    if denied.present? && domain_in?(domain, denied)
+      invalid = true
+    end
+    if allowed.present? && !domain_in?(domain, allowed)
+      invalid = true
+    end
+    errors.add(:address, l(:error_domain_not_allowed, :domain => domain)) if invalid
+  end
+
+  def domain_in?(addr, domains)
+    domain = addr.downcase.sub(/\A.*@/, '')
+    unless domains.is_a?(Array)
+      domains = domains.to_s.split(/[\s,]+/)
+    end
+    domains = domains.map{|s| s.downcase.sub(/\A.*@/, '')}.reject(&:blank?)
+    domains.include?(domain)
+  end
 end
diff --git a/app/views/settings/_users.html.erb b/app/views/settings/_users.html.erb
index ab61d7c21..8d446317a 100644
--- a/app/views/settings/_users.html.erb
+++ b/app/views/settings/_users.html.erb
@@ -4,6 +4,12 @@
     <p><%= setting_text_field :max_additional_emails, :size => 6 %></p>

     <p><%= setting_check_box :unsubscribe %></p>
+
+    <p><%= setting_text_area :email_domains_allowed %>
+    <em class="info"><%= l(:text_comma_separated) %> <%= l(:label_example) %>: foo.example.com, bar.example.org</em></p>
+
+    <p><%= setting_text_area :email_domains_denied %>
+    <em class="info"><%= l(:text_comma_separated) %> <%= l(:label_example) %>: baz.example.net, qux.example.biz</em></p>
   </div>

   <fieldset class="box tabular settings">
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 7bb506c57..7d1c793e5 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -232,6 +232,7 @@ en:
   error_can_not_delete_auth_source: "This authentication mode is in use and cannot be deleted." 
   error_spent_on_future_date: "Cannot log time on a future date" 
   error_not_allowed_to_log_time_for_other_users: "You are not allowed to log time for other users" 
+  error_domain_not_allowed: "Domain %{domain} is not allowed" 

   mail_subject_lost_password: "Your %{value} password" 
   mail_body_lost_password: 'To change your password, click on the following link:'
@@ -476,6 +477,8 @@ en:
   setting_force_default_language_for_loggedin: Force default language for logged-in users
   setting_link_copied_issue: Link issues on copy
   setting_max_additional_emails: Maximum number of additional email addresses
+  setting_email_domains_allowed: Allowed email domains
+  setting_email_domains_denied: Disallowed email domains
   setting_search_results_per_page: Search results per page
   setting_attachment_extensions_allowed: Allowed extensions
   setting_attachment_extensions_denied: Disallowed extensions
diff --git a/config/settings.yml b/config/settings.yml
index d33523aeb..4dee88b26 100644
--- a/config/settings.yml
+++ b/config/settings.yml
@@ -53,6 +53,10 @@ password_max_age:
 max_additional_emails:
   format: int
   default: 5
+email_domains_allowed:
+  default:
+email_domains_denied:
+  default:
 # Maximum lifetime of user sessions in minutes
 session_lifetime:
   format: int

I have updated the patch:

• Changed the domain name matching to support subdomains. Now "example.com" matches "example.com", "foo.example.com", and "bar.example.com". Putting a dot at the beginning of the domain name like ".example.com" matches "foo.example.com" and "bar.example.com" but "example.com". If you want to only allow email address with "example.com" domain excluding subdomains, set "example.com" to "Allowed email domains" and ".example.com" to "Disallowed email domains"
• Made valid_extension? and extension_in? as class methods like attachment.rb
• Moved some tests from test/unit/user_test.rb to test/unit/email_address_test.rb that has been added in r19661
• Fixed RuboCop offenses that were hidden by .rubocop_todo.yml

Let's deliver this feature in Redmine 4.2.0.

I have updated the patch again.

• Changed the error message when the domain is not allowed from "Email contains a domain not allowed (example.com)" to simpler "Email is invalid" because the former detailed error message may give attackers useful hints to avoid restrictions especially on /account/register page
• Moved the Allowed/Disallowed email domains settings to after "Maximum number of additional email addresses" setting in order to put the email related settings together

Committed the patch.