Problem still exists after update to 3.5.1

Is the mail you refer the e-mail with the subject "A new private message has arrived from [SITENAME]"?

if so that is the same for all private messages:
See https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_messages/models/message.php#L337-L338

Correct, that's the mail! Generally, this shouldn't be the case in any mail sent from Joomla, that it uses the user's mail address as the sender address.

I believe that was a design decision

A design decision that means the that site sends an email claiming to be a user that has not sent the mail ? So the site spoofs the From email address ?

IMO it would be more correct to use the behalf

From Site Name <site@email-address.com> on behalf of From User Name <from-user@email-address.com>

In mail headers i think it would be somehitng like this:

To: To User Name <to-user@email-address.com>
From: From User Name <from-user@email-address.com>
Reply-To: From User Name <from-user@email-address.com>
Sender: Site Name <site@email-address.com>

Which in JMail would translate to something like this (didn't test)

$mail = JFactory::getMailer();
$mail->addRecipient('to-user@email-address.com', 'To User Name');
$mail->setFrom('from-user@email-address.com', 'From User Name', false);
$mail->addReplyTo('from-user@email-address.com', 'From User Name');
$mail->setSender(array('site@email-address.com', 'Site Name'));
$mail->setSubject('subject of the mail');
$mail->setBody('body of the mail');
$mail->Send();

@andrepereiradasilva

"From: From User Name from-user@email-address.com"

But it's not the user that the email is from. The email is from the site notifying that an Article has been created.

I'm no expert on this, but if i'm not mistaken, when you have the "Sender" mail header that becomes the "From" you see in the e-mail.

Some clients (ex: Outlook), when seeing the "Sender" and the "From" header transform into this:
From: Site Name <site@email-address.com> on behalf of From User Name <from-user@email-address.com>

others
From: From User Name <from-user@email-address.com> via Site Name <site@email-address.com>

other clients just display
From: Site Name <site@email-address.com>

See https://en.wikipedia.org/wiki/Email#Header_fields

@andrepereiradasilva

""Sender" mail header that becomes the "From" you see in the e-mail."

Not when the script locates the author of the Article and sets that users email address as the sender.

The contact emails had the same problem a while ago. When a visitor filled in a contact form and requested a copy ... they would get the copy with the from field populated with the email address of the contact instead of the site email address.

Not when the script locates the author of the Article and sets that users email address as the sender.

Nothing was changed in the "script". I know how it's working now, i read the code.
I'm just sharing my opinion about this with some code PoC.

@andrepereiradasilva

""Sender" mail header that becomes the "From" you see in the e-mail."

Nothing was changed in the "script"

If both your statements were true then the Joomla would have to login to the users email account and send the email from there.

The email is sent from the site but the email header shows the email address of the user who created the Article. Therefore when Joomla sends the email a script in Joomla must be setting the From address to that belonging to the user who created the Article.

Which ever way you look at it ... the email is From the site but the email (when received by the admin) lies and says it's from someone else.

i think your're not understanding what i'm saying. Let me try to explain further.

The email is sent from the site but the email header shows the email address of the user who created the Article. Therefore when Joomla sends the email a script in Joomla must be setting the From address to that belonging to the user who created the Article.

Which ever way you look at it ... the email is From the site but the email (when received by the admin) lies and says it's from someone else.

I'm not saying that, in latest staging, it doesn't do what you say, because it does.
Also i'm not saying i agree with the current behaviour, or else, i wouldn't be not proposing other solution ...
Also already told where i think that code actually is (read my comment on 12 Apr ).

If both your statements were true then the Joomla would have to login to the users email account and send the email from there.

No, that's not what i'm saying.

What i'm trying to explain is: There is a mail header called "Sender" that is used to identify the e-mail who sends the mail (the server/site) - see https://tools.ietf.org/html/rfc4021#section-2.1.3. This "Sender" header, by default, is populated with the same mail that the "From" header, but the "From" and the "Sender" mail headers can be different.

And that is what i'm suggesting, making the "Sender" mail header the site global config e-mail, and the "From" mail header the author e-mail.
And that change, if i'm correct, would result in:

Some clients (ex: Outlook), when seeing the "Sender" and the "From" header transform into this:
From: Site Name site@email-address.com on behalf of From User Name from-user@email-address.com

others into this:
From: From User Name from-user@email-address.com via Site Name site@email-address.com

other clients just display:
From: Site Name site@email-address.com

Ah I see what you mean now

Do we need any further changes here or the core is already doing what is requested here?

The plugin: plugins/content/joomla/joomla.php

Gets $users that have sendMail == 1 (=receive system messages)
and sends them an email for new articles, using a

$model_message = JModelLegacy::getInstance('Message', 'MessagesModel');

https://github.com/joomla/joomla-cms/blob/staging/plugins/content/joomla/joomla.php#L77-L93

It does not pass to the model_message a value for 'user_id_from'
thus the default is to use the email of current user, see default here:

https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_messages/models/message.php#L289-L292

About using

$mail->setFrom()
$mail->setSender()

to set different "from" and "sender",
i see that you cannot since both of the above methods set the "from", you can see this here:
https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/mail/mail.php

@ggppdk Good analysis. There isn't even a set method for $Sender in PHPMailer, you will need to assign a value directly in case you want to use it. So after doing a setFrom or setSender, you could assing a value to $Sender yourself.

Does that mean there is a solution and that someone will create a patch ?

i see that you cannot since both of the above methods set the "from"

:facepalm: :headbang: :wtf:

The email's 'From field' is being populated with the value of the email address of the person who created the Article. Logic would suggest that the email's 'From field' should be populated with the site email (the one in the Global Configuration) because it is the site sending the email. Surely it is just a matter of changing where the email's 'From field' fetches its value from ? And (if necessary) add the email's 'Reply to field' which should fetch the email address of the person who created the Article

Can someone point me to the file concerned please ?

$mail->setFrom()
$mail->setSender()
i see that you cannot since both of the above methods set the "from"

PHPMailer does not provide a method for setting SENDER, but it exposes a public property:

• public $Sender = '';

And only if Sender is not set , it will do: $this->Sender = $this->From
(just open the class PHPMailer file and look at it)

So all that is needed is this (and code i have found online, says that this is the way to do it):

$mail->Sender = 'site@email-address.com';

There was a similar issue (a while ago) with the contact form. When a visitor selected to receive a copy of their message they would receive a copy with the contacts email address in the 'From field'. A few lines of code were changed and the email 'From field' then showed the site email address.

Does the Contact form use a different mailing method to that of the system notifications ?

@Webdongle I'm confused about Issue, so i ask: A "Message" is meant about a new Article? As testing this Issue got Message, no E-Mail-Address to see:

Test on:

Joomla! 3.7.0-staging
macOS Sierra, 10.12.3
Firefox 50.1.0
PHP 7.0.4
MySQLi 5.5.53-0

closed - please see #13518