This module has a security vulnerability.
When you are in the configuration part of the module (Admin > Configuration > User Interface > Subscription Mail > Results) and then log out of your account, you are able to see a list of the emails that are subscribed using this module.
You may think this is not an issue, but if you enter the URL as a logged out user or non-user, you are still able to see this list.
Those links would be:
your base URL/admin/config/user-interface/subscription-email/result/
your base URL/admin/config/user-interface/subscription-email/result/nodes
This is a major privacy issue that could get people sued.
I understand that most people will not know how to access this, but it is still accessible and crawlable, and therefore I cannot use it.
I was excited, because aside from this (very big) issue, this works exactly how I wanted it to work for our website! Unfortunately, I can't use this until this issue is somehow fixed. :(
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | email-subscriber-list-exposed-to-non-authorized-users-2828130-7.patch | 1.88 KB | flux423 |
| #4 | Screen Shot 2016-11-23 at 11.54.08 AM.png | 225.87 KB | deepakaryan1988 |
| #4 | Screen Shot 2016-11-23 at 11.51.52 AM.png | 227 KB | deepakaryan1988 |
Comments
Comment #2
marketinggirl commentedComment #3
deepakaryan1988Thanks marketinggirl.
I'll check and review it asap.
Comment #4
deepakaryan1988@marketinggirl I have tried it on vanilla Drupal, I am unable to reproduce it, also I have tried this in on going project, never faced this issue.
I think there is something else is causing a problem(may be some other custom modules).
See the screenshot.
Comment #5
sagar ramgade commentedThis seems to be a problem when we anonymous user or unauthorised authenticate user has permission of "total subscription permission", see the access arguments for links below:
$items['admin/config/user-interface/subscription-mail/result'] = array(
'title' => 'Result',
'page callback' => array('total_subscription_taxonomy_search'),
'access arguments' => array('total subscription permission'),
'type' => MENU_LOCAL_TASK,
'expanded' => TRUE,
'weight' => 3,
);
$items['admin/config/user-interface/subscription-mail/result/taxonomy'] = array(
'title' => 'Taxonomy',
'access arguments' => array('total subscription permission'),
'type' => MENU_DEFAULT_LOCAL_TASK,
'weight' => 1,
);
Comment #6
deepakaryan1988@marketinggirl Please see the comment #5
Thanks @Sagar Ramgade
Comment #7
flux423I think the module permissions are too general. Looks like we need another set of permissions to separate the anonymous user with administrative users.
Here's a patch suggested by comment #5 that adjusts the 'total subscription permission' description and adds a new permission named 'total subscription admin permission' to help control the admin pages from being viewed by anonymous users.
Using this patch, you can set the 'total subscription permission' to anonymous and set the new permission to just admins.
Comment #8
deepakaryan1988Thanks @flux423 for uploading patching.
I am currently travelling.
@Pratik60 could you please test this out and confirm whether it's working or not? and later merge it with dev branch?
Cheers!!
Comment #9
deepakaryan1988Thanks @flux423 for patch. I have tested it and merge with dev.
Soon, I'll release next version.
Comment #10
flux423Great to hear @deepakaryan1988.
Tell me if you need any other assistance.