Does anyone use Mage_Sendfriend?

[colinmollenhour]

I personally disabled this many years ago and never looked back.. Reasons:

• Users should be able to easily compose an email to their friends, or text message or social media post, they don't need a feature in a website to send an email.
• I rarely if ever see this feature on other websites, and if I did, I wouldn't use it due to privacy concerns for myself and the recipient.
• This feature is nothing more than an attack vector for abuse since it uses the store's email server to sends emails triggered by unverified users to unverified emails. You could probably even get in trouble with your email provider if it was misused, such as having your email service defer your emails or hold your account.
• This is one of the number one sources of reports on our HackerOne program - not that hackers find real vulnerabilities, just they keep reporting known limitations like lack of any sort of rate limit or abuse prevention mechanisms.
• This feature lets the user set a From address but with DKIM and SPF there is very little chance that these emails will even be delivered because the envelope address will not have permission to send emails for the From address.

So are there any reasons to keep it or can we just retire it to a module in a separate repo in a future release? It looks like it was disabled by default in Magento 1.9.4.2 5 years ago with a note "This functionality is vulnerable and can be abused to distribute spam.", but for existing stores that had already saved that config page, the default in the xml will not override the database value. In my opinion, if someone really wants this feature, they should have to install it in a separate module as I'm not really interested in supporting it as part of the core.

[sreichel]

+1 to outsource ... #4140

[sreichel]

Can you please create a repo openmage/module-mage-sendfriend?

[colinmollenhour]

Sorry if I never followed up on this, I can't remember, but the repo has been created and organization permissions updated so collaborators can create public repos on their own.

[sreichel]

Repo is set up - thanks - but there is some code that makes it difficult to split it.

There is code in reports, in Mage_Core ...

Working on it, but may take some days.

[ajbonner]

I really like the idea of moving (putting to pasture) features like this that frankly need to go, but have some sort of process for those that still need it, to have it.

[colinmollenhour]

I think I meant for one of the poll options to be "remove it entirely".. Oops!
Anyway, looks like 90% are in favor of moving it out of core into a separate repo. Thanks for the votes!

[sreichel]

Are you working on it? I'd stop my attempts.

[colinmollenhour]

I'm not working on it.