Steps to reproduce

Configure as admin:

  1. Create a newsletter with "Opt-in/out method" = "Double"
  2. Add a field to the subscriber entity, for example field_name
  3. Create a subscription block for the new newsletter

Exploit as hostile Anonymous:

  1. Attempt to modify the subscription of an existing anonymous subscriber
  2. Correct: cannot change the newsletter subscriptions without email confirmation
  3. Bug: can edit the name without email confirmation

Proposed resolution

Fixed by #3238247: Major confusion for subscriptions during user registration

CommentFileSizeAuthor
#10 simplenews.anon-fields.3152102-10.patch6.35 KBadamps
#3 3152102_3.patch1.52 KBnejcramsak

Comments

AdamPS created an issue. See original summary.

adamps’s picture

adamps commented
Priority: Normal » Critical
nejcramsak’s picture

nejcramsak commented
Status: Active » Needs review
StatusFileSize
new 3152102_3.patch1.52 KB

Hi, i created a patch for this. Needs review.

Status: Needs review » Needs work

The last submitted patch, 3: 3152102_3.patch, failed testing. View results

adamps’s picture

adamps commented
Status: Needs work » Active

Thanks but this issue is quite a lot more complex than that! The fix will likely depend on #3035367: Track history of subscribe/unsubscribe and proof of consent.

adamps’s picture

adamps commented
Version: 8.x-2.x-dev » 3.x-dev
adamps’s picture

adamps commented
Parent issue: » #3332695: Model for confirmations is flawed

I created #3332695: Model for confirmations is flawed which could be a good way to fix this.

adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Version: 3.x-dev » 4.x-dev
adamps’s picture

adamps commented
Status: Active » Needs review
StatusFileSize
new simplenews.anon-fields.3152102-10.patch6.35 KB

Most of the work was done in #3332695: Model for confirmations is flawed. This patch fixes a bug and adds some tests.

  • AdamPS committed ac64cced on 4.x 
    Issue #3152102 by AdamPS, nejcramsak: Anonymous user can alter fields of...
adamps’s picture

adamps commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.