command/envelope: Prompt before sending an encrypted message with Bcc

Currently alot cannot encrypt to Bcc recipients, and it isn't obvious
how to implement encrypted BCC without a metadata leak (the key ids of
the Bcc recpients would be visible to the to and cc recipients as well
as the other bcc recipients). As such it hasn't been implemented yet
(although #949) is opened for such encryption.

In the mean time alot doesn't encrypt to bcc recipients at all, making
the message all but useless (it might be useful to send it to yourself
as a blind recipient, or to two email addresses of the same person).
Since most people don't know that alot has this limitation, we should
really warn them. This adds a prompt before constructing the message
for that case.

1 files changed, 12 insertions, 0 deletions

diff --git a/alot/commands/envelope.py b/alot/commands/envelope.py
index 4a1482b6..9fa8fac3 100644
--- a/alot/commands/envelope.py
+++ b/alot/commands/envelope.py
@@ -11,6 +11,7 @@ import logging
 import os
 import re
 import tempfile
+import textwrap
 
 from twisted.internet.defer import inlineCallbacks
 
@@ -196,6 +197,17 @@ class SendCommand(Command):
                 logging.debug('sending this message already!')
                 return
 
+            # Before attempting to construct mail, ensure that we're not trying
+            # to encrypt a message with a BCC, since any BCC recipients will
+            # receive a message that they cannot read!
+            if self.envelope.headers.get('Bcc') and self.envelope.encrypt:
+                warning = textwrap.dedent("""\
+                    Any BCC recepients will not be able to decrypt this
+                    message. Do you want to send anyway?""").replace('\n', ' ')
+                if (yield ui.choice(warning, cancel='no',
+                                    msg_position='left')) == 'no':
+                    return
+
             clearme = ui.notify(u'constructing mail (GPG, attachments)\u2026',
                                 timeout=-1)