Repository: louislam/uptime-kuma
File: server/notification-providers/smtp.js (JavaScript)

Code before:
        const config = {
            host: notification.smtpHost,
            port: notification.smtpPort,
            secure: notification.smtpSecure,
        };

        // Handle TLS/STARTTLS options
        if (notification.smtpSecure) {
            // SMTPS (implicit TLS on port 465)
            config.tls = {
                rejectUnauthorized: !notification.smtpIgnoreTLSError || false,
            };
        } else if (notification.smtpIgnoreSTARTTLS) {
            // Disable STARTTLS completely for servers that don't support it
            // Connection will remain unencrypted
            log.warn(
                "notification",
                `SMTP notification using unencrypted connection (STARTTLS disabled) to ${notification.smtpHost}:${notification.smtpPort}`
            );
            config.ignoreTLS = true;
        } else {
            // Allow STARTTLS (default behavior for ports 25, 587)
            config.tls = {
                rejectUnauthorized: !notification.smtpIgnoreTLSError || false,
            };
        }

        // Fix #1129
        if (notification.smtpDkimDomain) {
            config.dkim = {
                domainName: notification.smtpDkimDomain,
                keySelector: notification.smtpDkimKeySelector,
                privateKey: notification.smtpDkimPrivateKey,
                hashAlgo: notification.smtpDkimHashAlgo,
                headerFieldNames: notification.smtpDkimheaderFieldNames,
                skipFields: notification.smtpDkimskipFields,
            };
        }

        // Should fix the issue in https://github.com/louislam/uptime-kuma/issues/26#issuecomment-896373904
        if (notification.smtpUsername || notification.smtpPassword) {
            config.auth = {
                user: notification.smtpUsername,
                pass: notification.smtpPassword,
            };
        }

        // default values in case the user does not want to template
        let subject = msg;
        let body = msg;
        let useHTMLBody = false;

Review comment (security):
```suggestion
        if (!notification.smtpSecure && notification.smtpIgnoreSTARTTLS) {
            // Disable STARTTLS completely for servers that don't support it
            // Connection will remain unencrypted
            log.warn(
                "notification",
                `SMTP notification using unencrypted connection (STARTTLS disabled) to ${notification.smtpHost}:${notification.smtpPort}`
            );
            config.ignoreTLS = true;
        } else {
            // SMTPS (implicit TLS on port 465)
            // or STARTTLS (default behavior for ports 25, 587)
            config.tls = {
                rejectUnauthorized: !notification.smtpIgnoreTLSError || false,
            };
        }
```

Code after:
        const config = {
            host: notification.smtpHost,
            port: notification.smtpPort,
            secure: notification.smtpSecure,
        };

        // Handle TLS/STARTTLS options
        if (!notification.smtpSecure && notification.smtpIgnoreSTARTTLS) {
            // Disable STARTTLS completely for servers that don't support it
            // Connection will remain unencrypted
            log.warn(
                "notification",
                `SMTP notification using unencrypted connection (STARTTLS disabled) to ${notification.smtpHost}:${notification.smtpPort}`
            );
            config.ignoreTLS = true;
        } else {
            // SMTPS (implicit TLS on port 465)
            // or STARTTLS (default behavior for ports 25, 587)
            config.tls = {
                rejectUnauthorized: !notification.smtpIgnoreTLSError || false,
            };
        }

        // Fix #1129
        if (notification.smtpDkimDomain) {
            config.dkim = {
                domainName: notification.smtpDkimDomain,
                keySelector: notification.smtpDkimKeySelector,
                privateKey: notification.smtpDkimPrivateKey,
                hashAlgo: notification.smtpDkimHashAlgo,
                headerFieldNames: notification.smtpDkimheaderFieldNames,
                skipFields: notification.smtpDkimskipFields,
            };
        }

        // Should fix the issue in https://github.com/louislam/uptime-kuma/issues/26#issuecomment-896373904
        if (notification.smtpUsername || notification.smtpPassword) {
            config.auth = {
                user: notification.smtpUsername,
                pass: notification.smtpPassword,
            };
        }

        // default values in case the user does not want to template
        let subject = msg;
        let body = msg;
        let useHTMLBody = false;
        if (heartbeatJSON) {
            body = `${msg}\nTime (${heartbeatJSON["timezone"]}): ${heartbeatJSON["localDateTime"]}`;
        }
        // subject and body are templated