[PATCH] send-email: confirm auto cc before sending

[Jay Soffian <jaysoffian@gmail.com>]

send-email violates the principle of least surprise by automatically
cc'ing additional recipients without even bothering to confirm this with
the user first.

This patch teaches send-email a new option --confirm-cc. In the case
where send-email has automatically added additional Cc recipients, it
will confirm the recipients with the user before sending.

It defaults to true unless another of the cc-related suppression options
has been specified, in which case it defaults to false.
---
Untested patch, just soliciting ideas. I actually don't like this patch
as is. I think a more general purpose --confirm option that takes
multiple values is in order:

 --confirm=never   never confirms
 --confirm=cc      confirms only when send-email has automagically added
                   additional recipient
 --confirm=always  always confirms

The default would be --confirm=cc unless the user has specified any of
the other Cc suppression options, which to me indicates the user knows
what they are doing.

j.

 git-send-email.perl |   29 +++++++++++++++++++++++++++--
 1 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/git-send-email.perl b/git-send-email.perl
index adf7ecb..d3e718e 100755
--- a/git-send-email.perl
+++ b/git-send-email.perl
@@ -75,6 +75,7 @@ git send-email [options] <file | directory | rev-list options >
     --[no-]thread                  * Use In-Reply-To: field. Default on.
 
   Administering:
+    --confirm-cc                   * Confirm automatic cc'd before sending.
     --quiet                        * Output one line of info per email.
     --dry-run                      * Don't actually send the emails.
     --[no-]validate                * Perform patch sanity checks. Default on.
@@ -181,7 +182,7 @@ sub do_edit {
 my ($thread, $chain_reply_to, $suppress_from, $signed_off_by_cc, $cc_cmd);
 my ($smtp_server, $smtp_server_port, $smtp_authuser, $smtp_encryption);
 my ($identity, $aliasfiletype, @alias_files, @smtp_host_parts);
-my ($validate);
+my ($validate, $confirm_cc);
 my (@suppress_cc);
 
 my %config_bool_settings = (
@@ -190,6 +191,7 @@ my %config_bool_settings = (
     "suppressfrom" => [\$suppress_from, undef],
     "signedoffbycc" => [\$signed_off_by_cc, undef],
     "signedoffcc" => [\$signed_off_by_cc, undef],      # Deprecated
+    "confirmcc"   => [\$confirm_cc, undef],
     "validate" => [\$validate, 1],
 );
 
@@ -258,6 +260,7 @@ my $rc = GetOptions("sender|from=s" => \$sender,
 		    "suppress-from!" => \$suppress_from,
 		    "suppress-cc=s" => \@suppress_cc,
 		    "signed-off-cc|signed-off-by-cc!" => \$signed_off_by_cc,
+		    "confirm-cc" => \$confirm_cc,
 		    "dry-run" => \$dry_run,
 		    "envelope-sender=s" => \$envelope_sender,
 		    "thread!" => \$thread,
@@ -346,6 +349,12 @@ if ($suppress_cc{'body'}) {
 	delete $suppress_cc{'body'};
 }
 
+if (!defined $confirm_cc) {
+    # defaults to true unless user has specified any of the other cc options
+    $confirm_cc = scalar %suppress_cc ? 0 : 1;
+}
+
+
 # Debugging, print out the suppressions.
 if (0) {
 	print "suppressions:\n";
@@ -943,7 +952,7 @@ foreach my $t (@files) {
 	my $author_encoding;
 	my $has_content_type;
 	my $body_encoding;
-	@cc = @initial_cc;
+	@cc = ();
 	@xh = ();
 	my $input_format = undef;
 	my @header = ();
@@ -1080,6 +1089,22 @@ foreach my $t (@files) {
 		}
 	}
 
+	if (@cc and $confirm_cc) {
+		print "Automatically cc'ing:\n";
+		print "	  $_\n" for each @cc;
+		print "Okay? "
+		while (1) {
+			$_ = $term->readline("Okay (y/n)?");
+			last if defined $_;
+			print "\n";
+		}
+		if (/n/i) {
+			$message_id = undef;
+			continue;
+		}
+	}
+	push(@cc, @initial_cc);
+
 	send_message();
 
 	# set up for the next message
-- 
1.6.2.rc1.309.g5f417