All the security issues have now been fixed, thanks to @ChrisZZ of "think modular" for sponsoring this final step. We now have a beta release! Stable release coming in early 2024.

Completed

  1. Security bug in the case where the subscriber entity has been extended with fields: #3152102: Anonymous user can alter fields of any subscriber.
  2. Major bug that affects sites that have enabled newsletters to appear on the registration form: #3238247: Major confusion for subscriptions during user registration. This is a regression in 3.x due to an incomplete fix for the security bug #3049356: Anon user can alter any anonymous subscription.
  3. Major redesign that enables fixes: #3332695: Model for confirmations is flawed.

Other non-BC issues:

Comments

AdamPS created an issue. See original summary.

adamps’s picture

adamps commented
Issue summary: View changes
chriszz’s picture

chriszz commented

How long would it take to fix this, and what is the required budget?

adamps’s picture

adamps commented
Issue summary: View changes

How long would it take to fix this, and what is the required budget?

Hi @ChrisZZ, thanks for your interest. As it says in the issue summary, it would be about 2 weeks of developer time total. If you'd like to discuss the matter further, please use my contact form and we can set up a call.

adamps’s picture

adamps commented

@ChrisZZ I received your message and sent you a reply at the start of February. I hope it reached you, and avoided your spam folder😃.

chriszz’s picture

chriszz commented

Hi Adam, for the moment, it seems better to use an existing open source newsletter tool - rather than to implement it within Drupal .... so we are not focusing on this anymore ...

ressa’s picture

ressa
he/him
commented

Thanks for showing an interest in sponsoring a stable release of the module @ChrisZZ. It's too bad it didn't work out ...

Among the 45,000 sites reporting using the module, there are probably big companies and organizations. It would be really awesome if some of them would consider sponsoring the remaining tasks, to get a stable, Drupal 10 supporting version released.

This is Open Source after all, and the free software we all enjoy, doesn't write itself :-)

chriszz’s picture

chriszz commented

Sure, I understand this and we sponsor lot's of modules.

It would help me and others if you were precise in terms of remaining amount of financial means needed and if received, how long it would take - so that one could decide to jump on the bandwagon.

If you send me those numbers, I will reevaluate - without promising anything here. ...

regards,

ressa’s picture

ressa
he/him
commented

@ChrisZZ: Thanks for a fast answer. I certainly did not mean to single you guys out. Quite the opposite, I am truly grateful that you showed an interest in the first place.

My aim was simply to get other, bigger organizations and companies to maybe take a look at their budget, and consider allocating a little bit of it, on a stable release of Simplenews, if they use it.

That being said, I don't even use the Simplenews module myself, so a maintainer such as @AdamPS would need to give you the details you request. Have a nice day.

adamps’s picture

adamps commented

If you send me those numbers, I will reevaluate - without promising anything here. ...

Great thanks for considering it. I sent you an email containing this information in February. I guess it didn't reach you so I've just resent it (to the address you used when sending me the initial contact using this site's form).

I hesitate to publish financial details here in case people consider it inappropriate to use the Drupal.org issue queue for seeking paid work. If anyone can offer guidance on that please leave a comment.

The Issue Summary states "about 2 weeks of developer time", so hopefully that gives a fair idea. Personally speaking, I offer a discounted rate when hired for open-source work.

adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes

Thanks to @ChrisZZ of "think modular" for sponsoring a detailed investigation. I have updated the IS here, and will update the other issues next with detailed proposed changes.

The required changes and the time estimate are now solid: 76 hours. The funding for the remaining work is not yet confirmed, and any offers of sponsorship would be most welcome.

adamps’s picture

adamps commented
Issue summary: View changes
ressa’s picture

ressa
he/him
commented

Thank you @ChrisZZ for sponsoring an investigation and @AdamPS for doing it. Have a great weekend, you both deserve it.

adamps’s picture

adamps commented
Version: 3.x-dev » 4.x-dev

#3332695: Model for confirmations is flawed is fixed in 4.x dev

adamps’s picture

adamps commented
Issue summary: View changes
Status: Active » Needs review

The security bugs have now all been fixed and I created a first 4.x alpha release. Please install on your dev sites and start to test it.

Before making the first beta I would like to fix some of the other non-back-compatible issues listed in the IS.

adamps’s picture

adamps commented

Getting closer - 1 fixed, 1 ready to commit. Still 1 non-BC issue not yet started.

adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented
Issue summary: View changes
adamps’s picture

adamps commented

New release 4.0.0-alpha3 is available. The next release should be a beta - I'll just wait a while first in case of any serious bug reports.

adamps’s picture

adamps commented
Issue summary: View changes
Status: Needs review » Fixed

We now have a beta release! Stable release coming in early 2024.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

ressa’s picture

ressa
he/him
commented

A belated, but big thank you @adamps, and @chriszz from think modular for sponsoring a stable release of Simplenews 🎉

I have since used Simplenews in a client project, and it works extremely well.