Changed which email addresses the submission tool uses for confirmation emails and sending out full submission status URLs from the emails found in the submitted document (which could be empty, broken, or intentionally different than the original authors) to the author emails from the previous version, where a previous version exists. This fixes breakage which can occur when no valid email addresses can be found in a broken submission, and also ensures that at least one of the authors of a previous version signs off on a new version, preventing submission hijacking.

- Legacy-Id: 5650

ietf/submit/forms.py

@@ -354,7 +354,7 @@ class AutoPostForm(forms.Form):
     def send_confirmation_mail(self, request):
         subject = 'Confirmation for Auto-Post of I-D %s' % self.draft.filename
         from_email = settings.IDSUBMIT_FROM_EMAIL
-        to_email = self.cleaned_data['email']
+        to_email = self.draft.confirmation_email_list()
 
         confirm_url = settings.IDTRACKER_BASE_URL + urlreverse('draft_confirm', kwargs=dict(submission_id=self.draft.submission_id, auth_key=self.draft.auth_key))
         status_url = settings.IDTRACKER_BASE_URL + urlreverse('draft_status_by_hash', kwargs=dict(submission_id=self.draft.submission_id, submission_hash=self.draft.get_hash()))

ietf/submit/models.py

@@ -1,10 +1,10 @@
-import re, datetime
+import re, datetime                     # 
 
 from django.conf import settings
 from django.db import models
 from django.utils.hashcompat import md5_constructor
 
-from ietf.idtracker.models import IETFWG
+from ietf.idtracker.models import InternetDraft, IETFWG
 from ietf.person.models import Person
 
 
@@ -68,6 +68,15 @@ class IdSubmissionDetail(models.Model):
         return '<a href="http://datatracker.ietf.org/submit/status/%s/%s/">%s</a>' % (self.submission_id, self.submission_hash, self.status)
     status_link.allow_tags = True
 
+    def confirmation_email_list(self):
+        try:
+            draft = InternetDraft.objects.get(filename=self.filename)
+            email_list = list(set(u'%s <%s>' % (i.person.name, i.email()) for i in draft.authors))
+            import debug
+            debug.show('email_list')
+        except InternetDraft.DoesNotExist:
+            email_list = list(set(u'%s <%s>' % i.email() for i in self.tempidauthors_set.all()))
+        return email_list
 
 def create_submission_hash(sender, instance, **kwargs):
     instance.create_hash()

ietf/submit/utils.py

@@ -37,7 +37,7 @@ NONE_WG = 1027
 def request_full_url(request, submission):
     subject = 'Full URL for managing submission of draft %s' % submission.filename
     from_email = settings.IDSUBMIT_FROM_EMAIL
-    to_email = list(set(u'%s <%s>' % i.email() for i in submission.tempidauthors_set.all()))
+    to_email = submission.confirmation_email_list()
     url = settings.IDTRACKER_BASE_URL + urlreverse('draft_status_by_hash',
                                                    kwargs=dict(submission_id=submission.submission_id,
                                                                submission_hash=submission.get_hash()))
@@ -295,9 +295,8 @@ if settings.USE_DB_REDESIGN_PROXY_CLASSES:
     announce_new_version = announce_new_versionREDESIGN
 
 def announce_to_authors(request, submission):
-    authors = submission.tempidauthors_set.order_by('author_order')
-    cc = list(set(i.email()[1] for i in authors if i.email() != authors[0].email()))
-    to_email = [authors[0].email()[1]]  # First TempIdAuthor is submitter
+    authors = submission.tempidauthors_set.all()
+    to_email = list(set(submission.confirmation_email_list() + [u'%s <%s>' % i.email() for i in authors]))
     from_email = settings.IDSUBMIT_ANNOUNCE_FROM_EMAIL
     subject = 'New Version Notification for %s-%s.txt' % (submission.filename, submission.revision)
     if submission.group_acronym:
@@ -309,7 +308,7 @@ def announce_to_authors(request, submission):
     send_mail(request, to_email, from_email, subject, 'submit/announce_to_authors.txt',
               {'submission': submission,
                'submitter': authors[0].get_full_name(),
-               'wg': wg}, cc=cc)
+               'wg': wg})
 
 
 def find_person(first_name, last_name, middle_initial, name_suffix, email):