[NEW] Notify users when their email address change

app/lib/server/functions/setEmail.js

@@ -4,9 +4,40 @@ import s from 'underscore.string';
 import { Users } from '../../../models';
 import { hasPermission } from '../../../authorization';
 import { RateLimiter, validateEmailDomain } from '../lib';
+import * as Mailer from '../../../mailer';
+import { settings } from '../../../settings';
 
 import { checkEmailAvailability } from '.';
 
+let html = '';
+Meteor.startup(() => {
+	Mailer.getTemplate('Email_Changed_Email', (template) => {
+		html = template;
+	});
+});
+
+const _sendEmailChangeNotification = function(to, newEmail) {
+	const subject = settings.get('Email_Changed_Email_Subject');
+	const email = {
+		to,
+		from: settings.get('From_Email'),
+		subject,
+		html,
+		data: {
+			email: s.escapeHTML(newEmail),
+		},
+	};
+
+	try {
+		Mailer.send(email);
+	} catch (error) {
+		throw new Meteor.Error('error-email-send-failed', `Error trying to send email: ${ error.message }`, {
+			function: 'setEmail',
+			message: error.message,
+		});
+	}
+};
+
 const _setEmail = function(userId, email, shouldSendVerificationEmail = true) {
 	email = s.trim(email);
 	if (!userId) {
@@ -31,6 +62,12 @@ const _setEmail = function(userId, email, shouldSendVerificationEmail = true) {
 		throw new Meteor.Error('error-field-unavailable', `${ email } is already in use :(`, { function: '_setEmail', field: email });
 	}
 
+	const oldEmail = user.emails && user.emails[0];
+
+	if (oldEmail) {
+		_sendEmailChangeNotification(oldEmail.address, email);
+	}
+
 	// Set new email
 	Users.setEmail(user._id, email);
 	user.email = email;

app/lib/server/startup/email.js

@@ -428,6 +428,21 @@ settings.addGroup('Email', function() {
 		});
 	});
 
+	this.section('Email_changed_section', function() {
+		this.add('Email_Changed_Email_Subject', '{Email_Changed_Email_Subject}', {
+			type: 'string',
+			i18nLabel: 'Subject',
+		});
+
+		this.add('Email_Changed_Email', '<h2>{Hi},</h2><p>{Your_email_address_has_changed}</p><p>{Your_new_email_is_email}</p><a class="btn" target="_blank" href="[Site_URL]">{Login}</a>', {
+			type: 'code',
+			code: 'text/html',
+			multiline: true,
+			i18nLabel: 'Body',
+			i18nDescription: 'Email_Changed_Description',
+		});
+	});
+
 	this.section('Privacy', function() {
 		this.add('Email_notification_show_message', true, {
 			type: 'boolean',

packages/rocketchat-i18n/i18n/en.i18n.json

@@ -1192,6 +1192,9 @@
   "Email_already_exists": "Email already exists",
   "Email_body": "Email body",
   "Email_Change_Disabled": "Your Rocket.Chat administrator has disabled the changing of email",
+  "Email_Changed_Description": "You may use the following placeholders: <br/><ul><li>[email] for the user's email.</li><li>[Site_Name] and [Site_URL] for the Application Name and URL respectively.</li></ul>",
+  "Email_Changed_Email_Subject": "[Site_Name] - Email address has been changed",
+  "Email_changed_section": "Email Address Changed",
   "Email_Footer_Description": "You may use the following placeholders: <br/><ul><li>[Site_Name] and [Site_URL] for the Application Name and URL respectively.</li></ul>",
   "Email_from": "From",
   "Email_Notifications_Change_Disabled": "Your Rocket.Chat administrator has disabled email notifications",
@@ -3456,15 +3459,17 @@
   "You_will_not_be_able_to_recover": "You will not be able to recover this message!",
   "You_will_not_be_able_to_recover_file": "You will not be able to recover this file!",
   "You_wont_receive_email_notifications_because_you_have_not_verified_your_email": "You won't receive email notifications because you have not verified your email.",
+  "Your_email_address_has_changed": "Your email address has been changed.",
   "Your_email_has_been_queued_for_sending": "Your email has been queued for sending",
   "Your_entry_has_been_deleted": "Your entry has been deleted.",
   "Your_file_has_been_deleted": "Your file has been deleted.",
   "Your_mail_was_sent_to_s": "Your mail was sent to %s",
   "your_message": "your message",
   "your_message_optional": "your message (optional)",
+  "Your_new_email_is_email": "Your new email address is <strong>[email]</strong>.",
   "Your_password_is_wrong": "Your password is wrong!",
   "Your_push_was_sent_to_s_devices": "Your push was sent to %s devices",
   "Your_question": "Your question",
   "Your_server_link": "Your server link",
   "Your_workspace_is_ready": "Your workspace is ready to use 🎉"
-}
+}