NB Whilst fixing this bug note that simplenews_user_insert has a hard-coded reference to permission 'administer users'. This code is wrong because it disregards entity access hooks plus also we may be running from the command line called by drush.
This bug could get "sort off" fixed by #2937251: Prevent duplicate subscribers which could disallow step 3 entirely. However possibly a better fix is to allow step 3, but take care not to overwrite any existing settings until after the email address has been verified.
| Comment | File | Size | Author |
|---|---|---|---|
| #10 | simplenews.safe-register.3049356-10.patch | 4.37 KB | adamps |
Comments
Comment #2
adamps commentedComment #3
jonathanshawLooks like this is only a bug if email verification is not required when new users register; it's a feature otherwise.
Comment #4
adamps commentedI think you accidentally wrote it backwards. Too many nots and onlys!
If email verification is required then it seems clearly a bug. Anonymous users should not be trusted until they prove their email address, so mustn't be able to alter state until then.
If email verification is not required then presumably it is the intention of the site owner that users can join the site freely. If logged in users are allowed to edit subscriptions then users can also subscribe to newsletters without verification - and hence the site might as well turn off the email verification in simplenews too. However this scenario is illegal for public websites in many countries now and it's not something I feel we should prioritise for maintaining this module.
So I think 90% of the time it's a bug. But even if it's only a security bug in 10% of cases it's still a critical security bug
Comment #5
jonathanshawAh. So even if verification is required and the new user cannot login, 4 and 5 still happen (prematurely). Got it now.
Comment #6
pixelrainbow commentedHi,
my use case: a webshop using Commerce module, where visitors may only create an account after they successfully submitted their first order.
Registering an account triggers bug #4 ('BUG: Subscription XX is deactivated' - well, to be precise the active status flag is turned off for the given email address in Simplenews). No matter what option combinations I tried, this is always triggered somehow, effectively losing any previous newsletter subscribers who register an account later.
Is there a workaround to reset a given email's Simplenews status to "active", if it was active before the creation of the account?
This bug sadly breaks the whole email marketing setup for the webshop.
Comment #7
adamps commentedSorry, I don't know of any easy workaround. @pixelrainbow if you are willing to support a proportion of the cost of fixing then please get in touch. Otherwise we need to wait and hope someone creates a patch.
Comment #8
drupal.ninja03 commentedComment #9
adamps commentedComment #10
adamps commentedHere is a slightly hacky fix for this problem.
The subscriptions during user registration are marked as unconfirmed and a confirmation email is sent. This solves the security bug but it's a bit untidy. However it's probably the best we can do until #3035367: Track history of subscribe/unsubscribe and proof of consent.
Comment #11
adamps commentedComment #13
adamps commented