I downloaded the latest change 1.2.0 and found that with the "Allow User Data Modification" set to off the following is still possible:

Any unidentified visitor can insert a subscribers email and change the subscription setting (i.e. cancel all subscriptions). The setting does not cancel this possibility.

It has fixed the previous vulnerability of being able to make unauthorised name changes. However, it still gives a "Changes saved successfully" message when trying to make changes to the name.

David

We are not allowed to block the subscription modifications for the reason that any user should be able to remove his subscription (well, depending on your country and your spam laws).
We blocked the user data modifications, not the subscription.

But you can configure unsubscription confirmation so the user will know that he has been unsubscribed.
In this unsubscription confirmation, you can even add a link so if the user clicks on it, he will be re-subscribed to the list (using the subscription via url).

The user has full control over his subscriptions and details if he clicks on the "modify my details" link in every newsletter. This way he provides the site with identification.

There should be no fully open door for anyone to change anyone else's subscriptions even if he gets a notification mail. As far as I am aware no other newsletter system allows unauthorised change of subscriptions.

The common solution for visitor changes of subscription usually has the following logic:

- The visitor enters his email and attempts to change details.
- A message appears saying that his identity needs to be verified and that a mail to the user has been sent.
- The user finds the mail with a "modify my details" link and returns to the site via the link
- The site now has the users identity and allows update of details and change of subscription.

If this security hole remains it will not be possible to use this newsletter system in our production site and I would hope to get a refund on the license purchased.

David,

1/ As far as I am aware it's working the same way with all other Joomla Newsletter components except that they don't even give you the possibility to block the user information.

2/ Our priority is to make our clients happy. We love Joomla, we love its community. If you want a refund, we will give you a refund.

3/ This is not a security hole at all. The user is aware of the changes applied to his account so if it's not his own action, he will always be able to revert it.

Your point is that the user should not be able to change his subscription. If he does, a message will be sent so he will first have to click on a link in the e-mail to be able to change it.

My point is that the user should be able to easily change his subscription and if somebody else changes his subscription, he should be aware of it and being able to revert it.

I think this way because I know that 99% of cases the user wants to change his subscription and only in 1% (probably even less) it's a voluntary action by somebody else which should not be allowed so that's why I personally prefer give the possibility to handle the process this way.

There is a possibility in the AcyMailing module to display an unsubscribe button so the user can enter his e-mail and click on unsubscribe.
Should we send an e-mail to the user asking to click on a link although he already clicked on the unsubscribe button? (this is not legal in some countries)


Our goal is to make AcyMailing the best Newsletter component available for Joomla.
I guess your goal is to use the best Newsletter component available for Joomla.
I think we already proved that we were able to listen to our customers and release shortly improvements in AcyMailing.

Even if I disagree with you, I'm sure we can both be very happy by making an extra option for that. We won't use it and we won't make it enabled by default in AcyMailing but you and other users will be able to turn it on.

John,

My first priority is to achieve a workable solution using AcyMailing. I love Joomla! too and as a previous member of the core development team on J!1.5, I can appreciate an extremely well coded component such as AcyMailing. It really is a high class development in all aspects and it is able of providing all the features that I need while being well integrated with Joomla!

Let's agree to disagree on the following


My feelings are that the average user would be somewhat upset if he found that his subscriptions had been changed by some other visitor (not an admin) even if he received notification of the fact.


My vote is for security over ease of use. I think that users will even appreciate the fact that making a change is somewhat more difficult if he understands that the reason is for his own security.


I will most gratefully agree to your suggestion to add yet another option to lock unidentified subscription changes. I think that it is OK if by default the lock is off.

Thanks,
David

We are adding an other option to this system to also lock the subscription if the user is not identified.
It should be ready at the end of next week (probably before).

Just to keep you informed, the development of this option is done but we could not package it and test it for this week.
Some of our developers will be at the French Joomla! Day this weekend so we won't be able to finish it this weekend, it will be done begin of next week and we will directly e-mail you with the new version.

I don't know when you purchased AcyMailing but your 30 days money-back will be extended to 60 days if necessary.

Thanks for the update.

The modification is truly appreciated and we will wait for it.
As I mentioned in this thread my preference is to stay with Acymailing as we are really extremely happy with it. The only show-stopper would have been the open access to change user data but now it seems that this is solved.

BTW - Everything else is so perfect that I would have hacked the change just to stay with Acymailing

Thanks again and enjoy the Joomla! weekend.

David

I've just finished testing the modification that completely resolves this issue of visitor changes to his data and subscriptions.

The verification email confirms that the visitor is whom he claims to be and then updates can be performed.

A perfect solution and we now have a nice and tight production site.

Thanks to all the team.

David

Hi,

Thank you for your report.