Security issue with mails in draft mode

[foreverneilyoung]

Hi,

I’m creating an outlook message following the sample given here:

http://www.aspose.com/demos/.net-components/aspose.network/csharp/file-format/create-msg-draft-status.aspx

This is done on an ASP.NET server page. The created mail is saved server side and presented as link to be downloaded after the creation. This works. After the download Outlook pops up client side with the mail ready to be sent. “To”, “Subject”, “Body” and “Attachment” are already pre-filled, “From” not, because “From” needs to be set by the final sending machine. I’m having an Outlook Automation solution (which I wanted to replace, because it requires an Office installation server side - grrrr), which does exactly that and fine since years.

If I send the mail from my corporate Outlook (MS Exchange behind) MS Exchange sends me a message back: “You are not allowed to send this message, because you are trying to send on behalf of another sender”.

If I send the mail from another machine with a local Outlook installation to my corporate account, the mail drops in on my corporate Outlook as attachment “OriginalMessage.txt” and a body, which tells this

“The content of the attached message is possibly untrustworthy, because the viewable originator-addres may not correspond with the actual originator-address. In the sender’s addres is not a domain included (no @). If this email is needed, contact the sender to change the server address.”

The latter message corresponds to the first, seems to be the same reason. But again - I do not fill the “From” part.

Unfortunately I cannot reproduce that on your demo page, because leaving “From” empty runs into an error.

So I suspect you are pre-setting “From” or any other “From” related field somehow, which clashes with Outlook’s internal knowledge. I also tried to apply the “FROM_ME” flag to no avail.

Kind regards

[saqib.razzaq]

Hi,

This is a known issue with Outlook 2010 connected to Exchange 2007/2010. To overcome this issue, please use a pre-created empty MSG draft file saved in unicode format. Load this empty MSG file in your code and fill the necessary fields and again save as draft, this should work with any Exchange user, who downloads the draft file.

Below is the sample code to load the unicode format MSG file, fill in the subject, recipients, attachments, embedded attachments and HTML body.

MapiMessage msg = MapiMessage.FromFile(“untitled.msg”);

msg.Subject = “test subject - äöü”;

// add recipients
msg.Recipients.Add("user@domain.com", “Display Name”, MapiRecipientType.MAPI_TO);

// add regular attachments
msg.Attachments.Add(“Document.docx”, File.ReadAllBytes(“Document.docx”));
msg.Attachments.Add(“aspose.png”, File.ReadAllBytes(“aspose.png”));

// add embedded attachment
msg.Attachments.Add(“imgAspose”, File.ReadAllBytes(“aspose.png”));
MapiAttachment attach = msg.Attachments[2]; // 2nd one is embedded
// set the content id property of the attachment
MapiProperty mapiProperty = new MapiProperty(MapiPropertyTag.PR_ATTACH_CONTENT_ID_W, Encoding.Unicode.GetBytes(“imgAspose”));
attach.SetProperty(mapiProperty);

// HTML body
msg.SetBodyContent("Bold text

Unicode äöü

red text

", BodyContentType.Html);

// set necessary flags
msg.SetMessageFlags(MapiMessageFlags.MSGFLAG_UNSENT | MapiMessageFlags.MSGFLAG_HASATTACH);

msg.Save(“test.msg”);

[foreverneilyoung]

Hmm. Not sure I understand: I described two differen scenarios, which seem to run into the same problem, so I try again:

a) I have a webserver running your Aspose.Network DLL. It creates mails on demand

b) If I download it to my local machine and send it to my corporate Exchange using my local Outlook 2003 (!!) installation, the mail arrives my corporate account, but is marked as suspecious, with the original mail attached

c) If I download it to my corporate machine (also Outlook 2003) I can't even send the mail, because the Exchange server refuses to send it (see above).

So how can you say, it is related to Outlook2010? Don't see that here.

Furthermore I don't understand, where to create the mentioned template. If I do that on my Outlook 2003 the only chance I have is to save it as .DOC, docx, wps, txt, rtf... but not as .msg.

So I don't understand your response.

Kind regards

PS: Now that I have a 2010 template I can't follow your code. E.g. MapiMessage.Subject is read only!?!. I'm using v. 6.1.0.0. Did that change? Also - msg.Recepients.Add is not possible as you noted it...

[foreverneilyoung]

Other than that I can confirm, your work around does the job, if I switch to the latest version 6.6. Is it possible to use MapiMessage from a template with 6.1 also?

Can you give me a commercial contact for some license issue discussions?

Kind regards

[saqib.razzaq]

Hi,

We noted such security issues with the latest version of Outlook 2010 connected with Exchange Server 2010. It might be due to some latest patches from Microsoft that our previous method (MailMessage to MapiMessage convert and then save as draft) stopped working.

We added the editing of subject, recipients etc in MapiMessage class in a recent version 6.4. So, it will work with 6.4 or later versions only.

For sales and licensing inquiries, please post in our Purchase forums, they will help you.