CiviCRM Community Forums (archive)

I may be missing something, but just discovered today what seems like a major security flaw in email subscription pages:

Groups that have Mailing List unchecked, and access set to User and User Admin only, can still be accessed from subscription pages when gid=x is set. 

The list are correctly omitted from the mailing list subscription listing when gid is not specified.

To recreate on the demo server:
(See the Administrator sign-up page)
http://drupal.demo.civicrm.org/civicrm/mailing/subscribe?reset=1&gid=1
(but then on the list overall the Administrator page does not show up)
http://drupal.demo.civicrm.org/civicrm/mailing/subscribe?reset=1

It doesn't look like emails are actually being added to the lists, but isn't it the case that they shouldn't show up if access is set to User and User Admin?

Further, I don't seem to be able to successfully sign-up to a mailing list, even when I am supposed to be able.  When I submit the form at
http://drupal.demo.civicrm.org/civicrm/mailing/subscribe?reset=1
with one or more of the Public lists checked I would expect the contact to show up with pending status.

Chris

done:  http://issues.civicrm.org/jira/browse/CRM-3603

C