salesagility / SuiteCRM

SuiteCRM - Open source CRM for the world
https://www.suitecrm.com
GNU Affero General Public License v3.0
4.39k stars 2.06k forks source link

Outbound email password not saved correctly for long passwords like API keys #10506

Open ExcelsiorEyer opened 3 weeks ago

ExcelsiorEyer commented 3 weeks ago

Issue

SMTP password for personal outgoing email is not being saved correctly if it is a long password like an API key. Adding debug steps to include/OutboundEmail/OutboundEmail.php seems to indicate that the stored encrypted password is being truncated to 100 chars, causing an incorrect password to be used for authenticating with the SMTP server

Version 7.14.5 Sugar Version 6.5.25 (Build 344)

Possible Fix

Increase the field length of outbound_email.mail_smtppass to a much larger value to allow for the encryption of API keys provided by SMTP providers

Steps to Reproduce the Issue

1. Set the password to be 100 characters for an outbound SMTP email. This will cause the encrypted text to be stored in the database to exceed the 100 character limit
2. Try sending an email to find the SMTP authentication failing

Context

No response

Version

7.14.5

What browser are you currently using?

Chrome

Browser Version

No response

Environment Information

MySQL, PHP8.2

Operating System and Version

Ubuntu

chris001 commented 3 weeks ago

Unlike the username field mail_smtpuser which has maxlength=100 on the web form, this password mail_smtppass doesn't have a maxlength on the web form! So it misleads you into believing you can paste in an app password longer than 100 characters, because there is no maxlength. Suite silently fails to save the full app password when the database truncates to the size of the field in the DB, resulting in first 100 characters saved, then SMTP Auth fails, and sending Outgoing Email fails.

ExcelsiorEyer commented 2 weeks ago

Just to clarify, in my case the actual password is short of 100 characters. So limiting the password to 100 characters on the front end will not solve the problem if the encrypted value were to exceed 100 characters in length.