Update calendar event attendee status from email response with attached ics about mail HOT 4 OPEN

I didn't find anything specific in the RFC, but some parts of the "Authentication" and "Security Considerations" chapters indicate that yes, when we receive a REPLY from an external user, we should process this from Mail into the calendar. But only for the ORGANIZER.

Is the RFC you are referencing this one?

We don't have this at the moment.

Theoretically, we should only accept messages that are S/MIME signed if we want to process them automatically. @PatrickJosh are such replies from external users signed for you?

No, they are not. I can provide you one of these emails if you want, but since they contain quite a lot of personal information, preferably privately (e.g. via email).
But you can also easily generate one yourself if you have a GMail address; just invite this address and accept the invitation using GMail's UI, i.e. not by clicking the link that leads to the organiser's Nextcloud.

If they're not, we should offer the ORGANIZER a choice - would they like to process the message or would they like to ignore it?

That sounds sensible from a security point of view.

from mail.

@miaulalala should this be covered by #6812?

from mail.

I didn't find anything specific in the RFC, but some parts of the "Authentication" and "Security Considerations" chapters indicate that yes, when we receive a REPLY from an external user, we should process this from Mail into the calendar. But only for the ORGANIZER.

We don't have this at the moment.

Theoretically, we should only accept messages that are S/MIME signed if we want to process them automatically. @PatrickJosh are such replies from external users signed for you?

If they're not, we should offer the ORGANIZER a choice - would they like to process the message or would they like to ignore it?

from mail.

I have the same issue with outlook.com invitations. People will always click on the "yes" or "no" at the top and this handled correct by all email clients I used so far.

from mail.