Send test email should not show SMPT user on failure #5322

New Issue

OVERLORD · 2026-02-05T09:57:46+03:00

OVERLORD commented

2026-02-05 09:57:46 +03:00

Originally created by @vnugent on GitHub (Jun 19, 2025).

Describe the Bug

I was trying to configure SMPT to work AWS SES. When Bookstack failing to send a test email due to configuration issue, the exception shows my smtp user. IMO this information may be shown in the server log but not in the frontend.

Steps to Reproduce

Log in as an admin
Go to Settings -> Maintenance -> Click Send test email

Expected Behaviour

The exception should not expose my smtp user.

Screenshots or Additional Context

No response

Browser Details

No response

Exact BookStack Version

25.05

Originally created by @vnugent on GitHub (Jun 19, 2025). ### Describe the Bug I was trying to configure SMPT to work AWS SES. When Bookstack failing to send a test email due to configuration issue, the exception shows my smtp user. IMO this information may be shown in the server log but not in the frontend. <img width="654" alt="Image" src="https://github.com/user-attachments/assets/45d2f9b9-12a8-40ce-a90c-f8252787a4c0" /> ### Steps to Reproduce 1. Log in as an admin 2. Go to Settings -> Maintenance -> Click Send test email ### Expected Behaviour The exception should not expose my smtp user. ### Screenshots or Additional Context _No response_ ### Browser Details _No response_ ### Exact BookStack Version 25.05

OVERLORD added the 🐛 Bug label 2026-02-05 09:57:46 +03:00

OVERLORD closed this issue

2026-02-05 09:57:46 +03:00

OVERLORD commented

2026-02-05 09:57:49 +03:00

@ssddanbrown commented on GitHub (Jun 19, 2025):

Thanks @vnugent,
Can you explain why you expect the desired behaviour?

This feature is specifically there to aid debugging, and would only really be made available to those with relatively high privileged rights.

@ssddanbrown commented on GitHub (Jun 19, 2025): Thanks @vnugent, Can you explain why you expect the desired behaviour? This feature is specifically there to aid debugging, and would only really be made available to those with relatively high privileged rights.

OVERLORD commented

2026-02-05 09:57:50 +03:00

@tjhart85 commented on GitHub (Jun 20, 2025):

Counter-argument: If you didn't enter your SMTP user correctly, you'll be able to see it here in the error rather than have to delve through logs. I don't see why you'd want to make this information harder to find when it's only showing in the first place because something specifically isn't working

@tjhart85 commented on GitHub (Jun 20, 2025): Counter-argument: If you didn't enter your SMTP user correctly, you'll be able to see it here in the error rather than have to delve through logs. I don't see why you'd want to make this information harder to find when it's only showing in the first place because something specifically _isn't working_

OVERLORD commented

2026-02-05 09:57:52 +03:00

@vnugent commented on GitHub (Jun 23, 2025):

Bookstack Admin user and Infra/devops person may be 2 different individuals. Generally as a security best practice I would want to minimize / leak any technical information (details about AWS infrastructure in this case) to the web app. Server logs are better place. Though I see your counterpoint.

@vnugent commented on GitHub (Jun 23, 2025): Bookstack Admin user and Infra/devops person may be 2 different individuals. Generally as a security best practice I would want to minimize / leak any technical information (details about AWS infrastructure in this case) to the web app. Server logs are better place. Though I see your counterpoint.

OVERLORD commented

2026-02-05 09:57:54 +03:00

@ssddanbrown commented on GitHub (Jun 23, 2025):

Maybe, but I expect the authority of a admin user to be relatively high enough not to specifically be seeking trouble, at least relative to what might information might come back from SMTP servers when something is specifically going wrong or incorrectly configured.

I'm going to close this off since this comes down to expectations of what will be shown, and I think the convenience is greater than risk here.

@ssddanbrown commented on GitHub (Jun 23, 2025): Maybe, but I expect the authority of a admin user to be relatively high enough not to specifically be seeking trouble, at least relative to what might information might come back from SMTP servers when something is specifically going wrong or incorrectly configured. I'm going to close this off since this comes down to expectations of what will be shown, and I think the convenience is greater than risk here.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5322