Wednesday, May 8, 2024
1 change · 17.0
Resolved issues and error corrections
This fix prevents an infinite email loop that occurred when security systems (like MS Defender) automatically clicked links in signing request emails and removed URL parameters. The system now properly validates signing requests before showing expiry messages, stopping bots from repeatedly triggering resend actions that generated massive unwanted emails.
Original PR description
Before this PR, the sign_request record was browsed but we did not checked if the record was correct.
Before this PR, when the sign_document_from_mail controller was
called without timestamp parameter, it would redirect to the
sign.sign_request_expired template because
current_request_item._validate_expiry(post.get('timestamp'),
post.get('exp')) would return False.
For human triggered interaction, it is not an issue.
Some customer complained of massive email sent. One of the signer is
probably relying on MS Defender. This is system is known to click on
links in email and cleaning the GET parameters of the URL.
In that case, the bot will get the sign.sign_request_expired which has a
button that allows to resend the sign request. If the bot click on that
button, it will send an email, that will be analyzed by the bot. it will
clean the parameters, get the sign.sign_request_expired template etc
etc.