Allow direct unflag

Are you sure that's the case?

I've checked the menu item for 'flag/confirm/%/%flag/%' and its callback is the flag_confirm() form. That doesn't check the token.

The path that checks tokens is the JS link path, 'flag/%/%flag/%'.

I am creating a RSVP feature with Flag and Rules but here's how the link looks like:

http://localhost/develphase/flag/unflag/bookmarks/365198?destination=admin/config/system/cron/execute/queue_rules_scheduler_tasks&token=m7EPAAQBqOQyG7p77p_cyl6xiuP61Vu7txUca5OxH50

Besides exposing the admin destination url, it only works if the user is logged in.
Perhaps with the help from tokenauth it could provide a one time login and then use the above token to unflag?

How on earth does your flag link get a cron destination? What is producing the link, and where?

> Perhaps with the help from tokenauth it could provide a one time login and then use the above token to unflag?

That sounds like a separate feature request.

The link is being provided from the [content:flag-bookmarks-link] token in rules "send mail" component sending me this via email for the RSVP flag.

In the case user is offline, there is error message:

    Bad token. You seem to have followed an invalid link.

Please find attached my rules configuration maybe you can manage to make some light into this.

One last thing, sometimes the link doesn't show up in the email's html. The number of flagged items work. Any idea?

typo error

Could you file a new support request on the Rules component please?