search

deliciousbrains / wp-offload-ses-lite

WP Offload SES Lite sends all outgoing WordPress emails through Amazon Simple Email Service (SES) instead of the local wp_mail() function.
https://wordpress.org/plugins/wp-ses/
14 stars 11 forks source link

Privacy Issue: "Verified Sender" Tab shows details of all websites linked to a AWS Account #17

Open shibindinesh opened 4 years ago

shibindinesh commented 4 years ago

The "Verified Sender" tab shows every Domain which we have verified for that particular region and thus using this Plugin on a client site will enable them to see other websites we manage that use the same service.

For individual users, this may not be an issue as there is only one domain, but I am sure there will be many developers who use SES to manage email delivery for multiple client sites and for us, one major factor of using AWS SES is the freedom to manage multiple websites from a single account and region making it very easy to manage to bill and keep track of accounts.

Since the users are created separately with their own unique Access keys for the SES to work, is the "Verified Sender" tab necessary to be shown in the plugin setting page? Or can you think of any method to show only the domain associated with the website and not every domain?

sanzwebdevelopment commented 3 years ago

Wondering if there is a response to this as well? I'm hosting a number of clients on a Vultr server, managed by SpinupWP so there is no mail configured on the server. Was hoping all client sites could send through the one SES setup, just different "users" configured, however can now see that each client domain is listed. How do we "hide" this info?

UPDATE - found that adding define( 'WPOSES_HIDE_VERIFIED', true ); to functions.php hides that tab. This will do nicely :-)

jonathanbossenger commented 3 years ago

Thanks, @shibindinesh and @sanzwebdevelopment , I'll make sure to add this info to our help docs.

crobbinsdg commented 1 year ago

Technically all the other identities are still saved to your database. The constant WPOSES_HIDE_VERIFIED only hides the UI in the Wordpress Admin.

If you are adding your identities outside of the plugin and you'd like to not have that data available at all just leave off the appropriate actions from your IAM Policy. Example remove ses:VerifyEmailIdentity, ses:DeleteIdentity, ses:GetIdentityVerificationAttributes, ses:ListIdentities, ses:VerifyDomainIdentity