Support

We have already written many times that this a feature we are not interested in implementing. It's dangerous.

All tickets are assigned to a Joomla! user account. Allowing guests to reply to tickets would mean that user ID 0 would be acceptable. That by itself is dangerous as it requires removing a sanity check and can lead to massive data corruption or worse (e.g. a user reading someone else's private posts). Sanity checks are put in place exactly to prevent this issues from happening.

Then we have the obvious issue of how the user could ever reply. There are three solutions, the dangerous, the stupid and the pointless.

The dangerous solution is automagically creating a new user account whenever an unknown email address is encountered in a new ticket. This is dangerous because:

• Any spammer will come and post a new public ticket. At this point they have a valid user account on your site which had to be necessarily activated (otherwise the user would never be able to reply to his ticket without logging in).
• The automatically created password is sent by email.
• If you have enabled ticket creation by email and a user sends a ticket from an email address other than the one on their user account you have Yet Another User Account for the same person.
• I CAN CREATE ARBITRARY USER ACCOUNTS ON YOUR SITE WITH JUST AN EMAIL ADDRESS. In other words I can use your site for social engineering attacks against other people.

Then there's the stupid solution: all you need to reply to a guest ticket is your email address. This is daft because email addresses are not secret by their nature. Therefore anyone can impersonate everyone else.

This leaves us with the pointless solution. Once you post a guest ticket a new, locked user account is created for you. An email is sent with an activation link and a temporary password. You have to first click on the activation link, then enter the temporary password, then enter a username, full name and a new password. Then you can reply. If you are paying attention that's a worse workflow than asking people to register for a free user account and THEN filing a free public ticket.

Since the only solution that makes sense is the pointless one which is equivalent to create account + post ticket we decided to not implement this feature. In short, we are not going to compromise the ticket system's privacy settings or the security of your site and we definitely won't waste time to implement what Joomla! already does very well.