Hello I didn't see that yet. Does the user have privileges to add email to the destination? If not, it should have been aborted.
Was that a move to an external email account added to SOGo? Kind regards, Christian Mack Am 21.10.20 um 11:31 schrieb mj ([email protected]): > Hi, > > Some additional info: > > We have (and already had) dovecot mail-log-plugin enabled > (https://doc.dovecot.org/settings/plugin/mail-log-plugin) and the logs > show NO copy action, only the DELETE. > > I verified our logging, to make sure that a COPY action would be logged, > and here is a sample, to prove that dovecot would log a copy action: > >> Thunderbird copy from INBOX to Drafts: >> Oct 21 11:17:38 mail dovecot: imap(username)<18022><gk7BzRaymJ7AV48W>: >> copy from INBOX: box=Drafts, uid=7410, >> msgid=<[email protected]>, >> from="Newpharma" <[email protected]>, subject=... >> Oct 21 11:17:38 mail dovecot: imap(username)<18022><gk7BzRaymJ7AV48W>: >> expunge: box=INBOX, uid=72758, >> msgid=<[email protected]>, >> from="Newpharma" <[email protected]>, subject=... > >> SOGo copy back from Drafts to INBOX: >> Oct 21 11:21:24 mail dovecot: imap(username)<10375><jbrH3SqywLDAV48G>: >> copy from Drafts: box=INBOX, uid=72759, >> msgid=<[email protected]>, >> from="Newpharma" <[email protected]>, subject=... >> Oct 21 11:21:24 mail dovecot: imap(username)<10375><jbrH3SqywLDAV48G>: >> delete: box=Drafts, uid=7410, >> msgid=<[email protected]>, >> from="Newpharma" <[email protected]>, subject=... > > So, it really seems that SOGo yesterday actually DELETED a message that > should have been copied, basically causing loss of emails for the end user. > > This looks quite disturbing. > > MJ > > > On 10/20/20 2:51 PM, mj ([email protected]) wrote: >> Hi, >> >> We received a complaint from one of our users, claiming she lost (and >> has lost before in the past) an email, while using the "move to" >> functionality in the SOGo webmail interface. >> >> Below is the timeline, hopfully formatting will survive: >> >>> 12:18:31.554 lda(username)<28404><EdEkIHe5jl/0bgAA4uZ9mg>: save: >>> box=INBOX, uid=9826, >>> msgid=<[email protected]>, from="zoom" >>> <[email protected]>, subject=.... >>> >>> 12:19:15:000 POST >>> /SOGo/so/username/Mail/0/folderINBOX/moveMessages HTTP/1.1 >>> >>> 12:19:15:229 sogod [13007]: |SOGo| starting method 'POST' on uri >>> '/SOGo/so/tomai/Mail/0/folderINBOX/moveMessages' >>> >>> 12:19:15:380 imap(username)<27062><d931dBeyhOPAV48G>: delete: >>> box=INBOX, uid=9826, >>> msgid=<[email protected]>, from="zoom" >>> <[email protected]>, subject=.... >>> >>> 12:19:15.382 sogod [13007]: 84.x.y.z "POST >>> /SOGo/so/username/Mail/0/folderINBOX/moveMessages HTTP/1.1" 204 0/73 >>> 0.173 - - 0 - 20 >>> >>> 12:20:26.569 imap(username)<28783><Z+Nmkxey4pPAV48G>: expunge: >>> box=INBOX, uid=9826, >>> msgid=<[email protected]>, from="zoom" >>> <[email protected]>, subject=.... >> >> and after this, the email is gone. >> >> She signed up again for the same zoom thing, received the email again, >> and this time the move to folder succeeded. >> >> She claims this has happened to her before, with a completely >> different (internal) email. >> >> If it actually happened like this, it would of course be very rather >> disturbing... >> >> The logs seem to backup her story: there is a moveMessages from SOGo, >> but nothing move-like is logged at the imap level, only a delete. >> >> We are slightly worried. :-| >> >> I will turn on ImapDebugEnabled = YES tonight, but what else to do? >> How to investigate this further? Has anyone ever seen something similar? >> >> She claims the first time she noticed this, was after we upgraded from >> latest 2.x to 4.x. >> >> Thanks! >> MJ -- Christian Mack Universität Konstanz Kommunikations-, Informations-, Medienzentrum (KIM) Abteilung IT-Dienste Forschung und Lehre 78457 Konstanz +49 7531 88-4416
smime.p7s
Description: S/MIME Cryptographic Signature
