Include username in email headers

[gwymor]

Emails from Gitea comments do not contain the username of the commenter
anywhere, only their display name, so it is not possible to verify who
made a comment from the email itself:

From: "Alice" <email@gitea>
X-Gitea-Sender: Alice
X-Gitea-Recipient: Bob
X-GitHub-Sender: Alice
X-GitHub-Recipient: Bob

This comment looks like it's from @alice.

The X-Gitea/X-GitHub headers also use display names, which is not very
reliable for filtering, and inconsistent with GitHub's behavior:

X-GitHub-Sender: lunny
X-GitHub-Recipient: gwymor

This change includes both the display name and username in the From
header, and switches the other headers from display name to username:

From: "Alice (@fakealice)" <email@gitea>
X-Gitea-Sender: fakealice
X-Gitea-Recipient: bob
X-GitHub-Sender: fakealice
X-GitHub-Recipient: bob

This comment looks like it's from @alice.

[delvh]

I think this value should be offered as a method in /models/user/user.go instead.
Perhaps something like GetCompleteName?
That way, it can be used by other parts as well.

[wxiaoguang]

It is quite confusing to introduce this "common" function into the User model.

For example:

• There is already GetDisplayName and DisplayName
• Why the GetCompleteName has an @ , is it a general approch .....

(I know the old code is not good, but introducing a new GetCompleteName here makes things more complex ....)

[wxiaoguang]

And maybe it should be reverted (or fixed):

[gwymor]

@wxiaoguang What displays that message? Are you aware of email providers/stacks that will take that as a sign of spam/phishing and flag the message? I would hope nothing would make that mistake as there's no user-part before the @.

If email providers do, we should probably drop the @, and display the sender as Display Name (username).

When a user has no display name the sender currently falls back to @username. If we change that to just username, I'm afraid that doesn't make it clear enough that this is a username that cannot be spoofed (aside from inspecting the X-Gitea/GitHub-Sender headers, which I think is too much to require a user to do in a spoofing attempt) -- you can't easily tell the difference between a post-1.22 Gitea sending a username, and a pre-1.22 Gitea sending a displayname that looks like a username. We could remove the fallback code, and always show Display Name (username), which will fall back to username (username). That would be more consistent and easy to verify at a glance, but perhaps noisy.

[wxiaoguang]

@wxiaoguang What displays that message? Are you aware of email providers/stacks that will take that as a sign of spam/phishing and flag the message? I would hope nothing would make that mistake as there's no user-part before the @.

I copied this screenshot from a user's feedback.

I think the root problem is that using @ in some places isn't a good security practice .....

(ps: I just shared the information here, but I haven't really looked into the problem nor I need this feature 🤣 )

[techknowlogick]

I don't want this to get lost, so I'm gonna open a new issue about it, and lock this thread. I'll ping everyone here, over there.