I suppose in many cases the login be the same as the sender and the sender is kind of maybe guessable? Nonetheless could be replaced maybe automatically by catching exception and throwing it again?

@tsteur Yes, exactly. Should be enough to do that for the password recovery only I guess, as that error message might be public visible

Looks like this is already fixed:

It might be possible that PHPMailer changed the code to no longer return the full SMTP error message. Nevertheless in the password recovery we maybe shouldn't reveal any error details as it might be public. Might be better so show something unspecific like An unexpected error occurred while sending the recovery mail. Please try again or contact the administrator if this error remains.

@sgiehl would there be much of a benefit? It might then be quite hard for users to troubleshoot where the problem is. I would have probably suggested the opposite to add maybe a sentence like "Please ask a Matomo administrator to check the configured Mail credentials in Matomo -> Administration -> General Settings".

@tsteur It's just important we replace the message coming from PHPMailer as it might contain any information we might not want to disclose in password recovery.

Decision:

In conversation with @tsteur and @justinvelluppillai we resolved this by intending to create an FAQ.

Now, the question is, should it be on one of these pages?

1. https://matomo.org/faq/how-to/faq_93/
2. https://matomo.org/faq/troubleshooting/faq_34856/
3. A new page which is linked to from 1. or 2.?

I think it should be 3., but 2. would get them there in one click with the current Google search for example:

https://www.google.com/search?client=firefox-b-d&q=smtp+error+could+not+authenticate+matomo

We checked the PHPMailer code and it throws a generic Exception for all errors, errors are translated, so even doing a substring match would be error prone. A bit unusual for such a high-profile project such as PHPMailer.

So, in short, the best solution we figured is to create an FAQ which users/admins would find easily with a search engine.

The original issue had already been resolved previously and we know no authentication configuration is leaked.

I would create a new FAQ in the troubleshooting category like How do I fix the error "SMPT Error... exact error message...".

We could link to this new FAQ in https://matomo.org/faq/troubleshooting/faq_34856/ also.

Changing library to PHPMailer already fixed this and we created FAQ for the error.