fake email address from display name is shown in message view

[rcubetrac]

Reported by heinrichmartin on 1 Mar 2013 10:39 UTC as Trac ticket #1488981

pishing mails often use fake email addresses in the display name:

e.g. "[email protected] [email protected]" (Trac cuts the paypal.com domain from [email protected])

this is displayed as "[email protected]". most browsers show the actual address in a hover message, but this fake should be visible more prominently.

The least fix required is not to allow the special character "@" in display names.

When implementing configurable display behavior for angle addresses / display names, the default should be to display both.

(also see ticket:1488732, but which was considered a different issue)

Keywords: spam display name fake email address
Migrated-From: http://trac.roundcube.net/ticket/1488981

[rcubetrac]

Comment by @alecpl on 9 Mar 2013 14:29 UTC

After some more thinking, I suppose we should at least not hide email address for cases when the name part is an email address itself.

[rcubetrac]

Milestone changed by @alecpl on 9 Mar 2013 14:29 UTC

later => 0.9-stable

[rcubetrac]

Comment by @alecpl on 12 Mar 2013 07:45 UTC

Fixed in ff7542b, so we just skip fake address.

[rcubetrac]

Status changed by @alecpl on 12 Mar 2013 07:45 UTC

new => closed