UVdesk should honor Reply-To field

[silviuchingaru]

Description
If a customer sends an email with an Reply-To header set, for example from an customer support team member that wants to receive reply to an department address (maybe the sending support team member is expecting to be on vacation or next tire should take the action when he expects to receive the answer and wants any other support member to act on that reply - a lot of companies use this support model), the UVdesk does not honor those Reply-To headers so the reply is received only by sending agent that may not have access to email or he is in he's own free time and don't want to read / forward emails. An example from Thunderbird:

So UVdesk, as an professional support system, should honor those Reply-To fields and always use Reply-To from last customer thread, if any. This should be at thread level not at ticket level because maybe the discussion takes multiple days and so on or next reply should be received by someone else. It's something like a customer calls and asks to be called on another number because he has no battery left on that phone, but agent is so dumb that he tries to call on first number anyway and never to new number as instructed by customer. This is definitely frustrating for the customer especially as those who use features like Reply-To are clearly professional not home users and they expect a professional approach in turn.

Maybe an option should be included in interface to allow agent to include original sender address as CC.

Also if multiple replies to fields are set, UVdesk should send email to all of those.

This is actualy a duplicate of uvdesk/community-skeleton#316 but I mailbox-component is responsable with emails so discussion should continue here.

[PeopleInside]

@fiftyz @Komal-sharma-2712 I'm waiting for this feature but you need consider a possible security issue that you need avoid.

First of all I need this function because I have the live helper chat installed on my website and if an offline message is leaved by the user a ticket is not created. Why? Because the offline message will be sent from my email address domain example livechat@domain.ext with the customer who leaved the message in reply to field.

In OsTicket administrator can create a rule using the filter UI where can set if email comes from livechat@domain.ext then check for a reply to address and use this.

What if this kind of filter is not set? If this is not present anyone can send an email from his email address and put as reply to the address of someone else. This can be used for impersonate someone else?

I think in OsTicket they implemented a secure system to use the reply to because you need allow with a specific filter. I hope UVdesk can do the same considering keep security height.

Currently I'm really waiting UVdesk can support in safe way a way to use reply to email address. I suggest to implement as workflow. Maybe workflow like: if the sender is this address than as action use the reply to address if is present elsewhere use the from email address.

Maybe a label in the ticket can indicate also the ticket is from a reply to email address.

This has been not implemented since 2020, we are in 2022 and soon 2023. I hope UVdesk can implement it soon.

[PeopleInside]

We must keep security on mind. Os-Ticket never allow by default the reply to https://github.com/osTicket/osTicket/issues/5650#issuecomment-707156175

Maybe the reply to should be used just if a specific workflow is created, this for security for prevent abuse or an abusive attacker can generate spam email sending emails from his account but with a reply to address that will generate unwanted emails to address of other people.

[akshaywebkul]

Hello @PeopleInside @fiftyz,

Thank you for your suggestions. I think the best way moving forward would be to modify workflows to able to handle email activities. You can define the conditions in your workflow where when an email is received from a specific address, the system should use the reply-to email address as the customer email address instead. I think that should meet your requirements.

I'm currently developing this feature and will create a pull request for the same following testing. I'll also raise separate issues if I find any security implications as per your recent feedbacks regarding handling emails with reply-to addresses provided.

References: uvdesk/community-skeleton#316

[PeopleInside]

Looks good, nice.

[komal-sh-27]

Hello @PeopleInside @silviuchingaru @fiftyz,

Thank you for your suggestions. We have added this new feature in the latest release v-1.1.3.

For now we are closing this issue. If you are facing any issue then reply in the same thread.