[18.0] mail_composer_cc_bcc: Mail header X-Odoo-Bcc leaks BCC e-mail adress to recipient

[glasl]

Module

mail_composer_cc_bcc

Describe the bug

Sending a message with:

To: mail_to@example.com
BCC: mail_bcc@example.com

the outgoing e-mails will receive an extra header X-Odoo-Bcc: mail_bcc@example.com.
This means, that mail_bcc will get leaked to mail_to in the source code (not shown in the e-mail client).

To Reproduce

Affected versions: [18.0], maybe earlier versions, too

Steps to reproduce the behavior:

To & BCC:

1. Send message in chatter (e.g. crm.lead): To: mail_to@example.com and BCC: mail_bcc@example.com
2. Inspect source code of both incoming e-mails for X-Odoo-Bcc: mail_bcc@example.com
3. Both, the recipient's and BCC's e-mail will contain the header X-Odoo-Bcc: mail_bcc@example.com

CC & BCC:

1. Send message in chatter (e.g. crm.lead): CC: mail_cc@example.com and BCC: mail_bcc@example.com
2. Inspect source code of both incoming e-mails for X-Odoo-Bcc: mail_bcc@example.com
3. Both, the recipient's and BCC's e-mail will contain the header X-Odoo-Bcc: mail_bcc@example.com

Expected behavior
I don't know the history of X-Odoo-Bcc, but I would not expect this header in any E-mail.
At least not in the E-mail sent to both, To: and/or CC:.

Edge Case: To, CC, BCC
If the message is sent to three contacts, one in To, CC and BCC, the header X-Odoo-Bcc will not be added to the message