View Issue Details

IDProjectCategoryView StatusLast Update
0018345phplist applicationStatisticspublic13-10-16 21:41
Reporterduncanc 
PrioritynormalSeverityminorReproducibilitysometimes
Status resolvedResolutionfixed 
Product Version3.3-RC2 
Target Version3.2.6Fixed in Version3.2.6 
Summary0018345: Link clicking in test messges is restricted to admins
DescriptionIn 3.2.6 RC1 there is some new processing that restricts clicking links in test messages to admins who are currently logged-in to phplist.

This looks to be a significant break of how phplist currently works and I expect it will surprise many people. One scenario is that an admin composes a message and then sends a test message to several subscribers for review. Suddenly clicking a link in the test email will give a 404 error.

What's the reason for the change? Possibly it can be controlled by a config setting, with the default to work as it currently does.
TagsNo tags attached.

Relationships

related to 0018369 new test messages when a sent campaign is edited may not work correctly 

Activities

michiel

02-10-16 13:48

manager   ~0058321

The change is part of general hardening. But I can see your point. I will review the change and think of a way to handle it.

michiel

06-10-16 11:49

manager   ~0058335

Reminder sent to: michiel


We should update the check and only disallow the personalised links

michiel

10-10-16 21:24

manager   ~0058349

I've now updated it, so that only the "unsubscribe" and "preference" links are blocked.

duncanc

11-10-16 09:25

developer   ~0058350

The $allowPersonalised is set incorrectly. it should be true instead of false.

The validation of whether a campaign has been sent at all could cause a problem. Consider a campaign being sent, then edited and a test email sent to a new subscriber. That would currently fail with a 404 error.

See https://github.com/phpList/phplist3/pull/88

michiel

11-10-16 11:40

manager   ~0058353

We may want to encode the "test message" status in the links, instead of reading it from the DB. I've merged your PR.

gingerling

13-10-16 16:12

manager   ~0058372

M, can you push these changes to the HOSTED6 and HOSTED6 plus, we still have tests failing with this issue

michiel

13-10-16 21:39

manager   ~0058373

Personalised links are disallowed, but other links will work.

I will open a new ticket to review this for a sent campaign being re-edited and then test emails being created.