From 076f45abb04b04cb0ddca53bcc5297638c1ee8f4 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Sun, 9 Aug 2026 23:59:54 -0400
Subject: [PATCH] Remove Stale SMTP IMAP host if switching Standard SMTP.IMAP
 to OAUTH

---
 admin/post/settings_mail.php | 48 ++++++++++++++++++++++--------------
 cron/mail_queue.php          | 23 +++++++++++------
 2 files changed, 46 insertions(+), 25 deletions(-)

diff --git a/admin/post/settings_mail.php b/admin/post/settings_mail.php
index f22ffd61b..21a7df080 100644
--- a/admin/post/settings_mail.php
+++ b/admin/post/settings_mail.php
@@ -91,6 +91,18 @@ if (isset($_POST['edit_mail_smtp_settings'])) {
     $config_smtp_username   = escapeSql($_POST['config_smtp_username'] ?? $config_smtp_username);
     $config_smtp_password   = escapeSql($_POST['config_smtp_password'] ?? $config_smtp_password);
 
+    // The host/port/encryption/password inputs are hidden and disabled for OAuth
+    // providers, so they never post and the ?? fallbacks above keep whatever the
+    // install used before. Clear them instead: the endpoint is fixed by provider,
+    // and the stored values would otherwise be both wrong and unreachable from
+    // the settings page. The mailbox password is no longer used either.
+    if ($config_smtp_provider === 'google_oauth' || $config_smtp_provider === 'microsoft_oauth') {
+        $config_smtp_host       = '';
+        $config_smtp_port       = 0;
+        $config_smtp_encryption = '';
+        $config_smtp_password   = '';
+    }
+
     mysqli_query($mysqli, "
         UPDATE settings SET
             config_smtp_provider              = '$config_smtp_provider',
@@ -121,6 +133,15 @@ if (isset($_POST['edit_mail_imap_settings'])) {
     $config_imap_username   = escapeSql($_POST['config_imap_username'] ?? $config_imap_username);
     $config_imap_password   = escapeSql($_POST['config_imap_password'] ?? $config_imap_password);
 
+    // Same as the SMTP handler above - the connection fields are hidden for OAuth
+    // providers and never post, so drop the leftovers rather than carrying them.
+    if ($config_imap_provider === 'google_oauth' || $config_imap_provider === 'microsoft_oauth') {
+        $config_imap_host       = '';
+        $config_imap_port       = 0;
+        $config_imap_encryption = '';
+        $config_imap_password   = '';
+    }
+
     mysqli_query($mysqli, "
         UPDATE settings SET
             config_imap_provider              = '$config_imap_provider',
@@ -259,26 +280,17 @@ if (isset($_POST['test_email_imap'])) {
 
     $is_oauth = ($provider === 'google_oauth' || $provider === 'microsoft_oauth');
 
+    // Override, don't default - a leftover standard-IMAP host from before the
+    // switch to OAuth would otherwise make this test fail against the old server
+    // while the cron parser (which overrides unconditionally) connects fine.
     if ($provider === 'google_oauth') {
-        if (empty($host)) {
-            $host = 'imap.gmail.com';
-        }
-        if (empty($port)) {
-            $port = 993;
-        }
-        if (empty($encryption)) {
-            $encryption = 'ssl';
-        }
+        $host       = 'imap.gmail.com';
+        $port       = 993;
+        $encryption = 'ssl';
     } elseif ($provider === 'microsoft_oauth') {
-        if (empty($host)) {
-            $host = 'outlook.office365.com';
-        }
-        if (empty($port)) {
-            $port = 993;
-        }
-        if (empty($encryption)) {
-            $encryption = 'ssl';
-        }
+        $host       = 'outlook.office365.com';
+        $port       = 993;
+        $encryption = 'ssl';
     }
 
     if (empty($host) || empty($port) || empty($username)) {
diff --git a/cron/mail_queue.php b/cron/mail_queue.php
index 9675d5c65..ebf483d33 100644
--- a/cron/mail_queue.php
+++ b/cron/mail_queue.php
@@ -198,16 +198,25 @@ function sendQueueEmail(
     string $oauth_access_token,
     string $oauth_access_token_expires_at
 ) {
-    // Sensible defaults for OAuth providers if fields were left blank
+    // Google and Microsoft each expose exactly one XOAUTH2 SMTP endpoint, so the
+    // stored host/port/encryption are overridden rather than used as a fallback -
+    // the same thing cron/ticket_email_parser.php already does on the IMAP side.
+    //
+    // These used to apply only when the columns were blank, which quietly broke
+    // every install that moved from Standard SMTP to OAuth: the old server is
+    // still sitting in config_smtp_host/port/encryption, the settings page hides
+    // those fields for OAuth providers so there is no way to clear them, and the
+    // send then pointed an M365 bearer token at the previous mail host. Only a
+    // fresh install, where the columns happened to be empty, ever worked.
     if ($provider === 'google_oauth') {
-        if (!$host) $host = 'smtp.gmail.com';
-        if (!$port) $port = 587;
-        if (!$encryption) $encryption = 'tls';
+        $host       = 'smtp.gmail.com';
+        $port       = 587;
+        $encryption = 'tls';
         if (!$username) $username = $from_email;
     } elseif ($provider === 'microsoft_oauth') {
-        if (!$host) $host = 'smtp.office365.com';
-        if (!$port) $port = 587;
-        if (!$encryption) $encryption = 'tls';
+        $host       = 'smtp.office365.com';
+        $port       = 587;
+        $encryption = 'tls';
         if (!$username) $username = $from_email;
     }