Hello

I didn't see that yet.
Does the user have privileges to add email to the destination?
If not, it should have been aborted.

Was that a move to an external email account added to SOGo?


Kind regards,
Christian Mack

Am 21.10.20 um 11:31 schrieb mj ([email protected]):
> Hi,
> 
> Some additional info:
> 
> We have (and already had) dovecot mail-log-plugin enabled
> (https://doc.dovecot.org/settings/plugin/mail-log-plugin) and the logs
> show NO copy action, only the DELETE.
> 
> I verified our logging, to make sure that a COPY action would be logged,
> and here is a sample, to prove that dovecot would log a copy action:
> 
>> Thunderbird copy from INBOX to Drafts:
>> Oct 21 11:17:38 mail dovecot: imap(username)<18022><gk7BzRaymJ7AV48W>:
>> copy from INBOX: box=Drafts, uid=7410,
>> msgid=<[email protected]>,
>> from="Newpharma" <[email protected]>, subject=...
>> Oct 21 11:17:38 mail dovecot: imap(username)<18022><gk7BzRaymJ7AV48W>:
>> expunge: box=INBOX, uid=72758,
>> msgid=<[email protected]>,
>> from="Newpharma" <[email protected]>, subject=...
> 
>> SOGo copy back from Drafts to INBOX:
>> Oct 21 11:21:24 mail dovecot: imap(username)<10375><jbrH3SqywLDAV48G>:
>> copy from Drafts: box=INBOX, uid=72759,
>> msgid=<[email protected]>,
>> from="Newpharma" <[email protected]>, subject=...
>> Oct 21 11:21:24 mail dovecot: imap(username)<10375><jbrH3SqywLDAV48G>:
>> delete: box=Drafts, uid=7410,
>> msgid=<[email protected]>,
>> from="Newpharma" <[email protected]>, subject=...
> 
> So, it really seems that SOGo yesterday actually DELETED a message that
> should have been copied, basically causing loss of emails for the end user.
> 
> This looks quite disturbing.
> 
> MJ
> 
> 
> On 10/20/20 2:51 PM, mj ([email protected]) wrote:
>> Hi,
>>
>> We received a complaint from one of our users, claiming she lost (and
>> has lost before in the past) an email, while using the "move to"
>> functionality in the SOGo webmail interface.
>>
>> Below is the timeline, hopfully formatting will survive:
>>
>>> 12:18:31.554    lda(username)<28404><EdEkIHe5jl/0bgAA4uZ9mg>: save:
>>> box=INBOX, uid=9826,
>>> msgid=<[email protected]>, from="zoom"
>>> <[email protected]>, subject=....
>>>
>>> 12:19:15:000    POST
>>> /SOGo/so/username/Mail/0/folderINBOX/moveMessages HTTP/1.1
>>>
>>> 12:19:15:229    sogod [13007]: |SOGo| starting method 'POST' on uri
>>> '/SOGo/so/tomai/Mail/0/folderINBOX/moveMessages'
>>>
>>> 12:19:15:380    imap(username)<27062><d931dBeyhOPAV48G>: delete:
>>> box=INBOX, uid=9826,
>>> msgid=<[email protected]>, from="zoom"
>>> <[email protected]>, subject=....
>>>
>>> 12:19:15.382    sogod [13007]: 84.x.y.z "POST
>>> /SOGo/so/username/Mail/0/folderINBOX/moveMessages HTTP/1.1" 204 0/73
>>> 0.173 - - 0 - 20
>>>
>>> 12:20:26.569      imap(username)<28783><Z+Nmkxey4pPAV48G>: expunge:
>>> box=INBOX, uid=9826,
>>> msgid=<[email protected]>, from="zoom"
>>> <[email protected]>, subject=....
>>
>> and after this, the email is gone.
>>
>> She signed up again for the same zoom thing, received the email again,
>> and this time the move to folder succeeded.
>>
>> She claims this has happened to her before, with a completely
>> different (internal) email.
>>
>> If it actually happened like this, it would of course be very rather
>> disturbing...
>>
>> The logs seem to backup her story: there is a moveMessages from SOGo,
>> but nothing move-like is logged at the imap level, only a delete.
>>
>> We are slightly worried. :-|
>>
>> I will turn on ImapDebugEnabled = YES tonight, but what else to do?
>> How to investigate this further? Has anyone ever seen something similar?
>>
>> She claims the first time she noticed this, was after we upgraded from
>> latest 2.x to 4.x.
>>
>> Thanks!
>> MJ


-- 
Christian Mack
Universität Konstanz
Kommunikations-, Informations-, Medienzentrum (KIM)
Abteilung IT-Dienste Forschung und Lehre
78457 Konstanz
+49 7531 88-4416

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

Reply via email to