CiviCRM Community Forums (archive)

*

News:

Have a question about CiviCRM?
Get it answered quickly at the new
CiviCRM Stack Exchange Q+A site
This forum was archived on 25 November 2017. Learn more.
How to get involved.
What to do if you think you've found a bug.



  • CiviCRM Community Forums (archive) »
  • Old sections (read-only, deprecated) »
  • Support »
  • Using CiviCRM »
  • Using CiviMail (Moderator: Piotr Szotkowski) »
  • civimail - Mailing List Subscription
Pages: [1]

Author Topic: civimail - Mailing List Subscription  (Read 1857 times)

kdas

  • I post occasionally
  • **
  • Posts: 44
  • Karma: 0
civimail - Mailing List Subscription
July 18, 2009, 08:31:08 pm
Hi All,

The default subscription to a mail group only requires email address. In order to get firstname, lastname, zip code along with the email we created a profile for newsletter subscription. Since the user will be anonymous, I gave the permission in drupal to anonymous users to access profile ('profile listings and forms'). Though enabaling this causes security risk for other profiles that we don't want any one to access.

For example for newsletter subscription the profile Id is 9 and url:
http://<xyz>/civicrm/profile/create?reset=1&gid=9

If someone changes the 'gid' in url to '1' he will have access to profile Id 1.

Is there any setting that could restrict people to use only 'gid' 9 in above example, or any better way to handle this?

-kdas

kdas

  • I post occasionally
  • **
  • Posts: 44
  • Karma: 0
Re: civimail - Mailing List Subscription
July 19, 2009, 09:02:12 am
Update:
Instead of giving access at drupal level to anonymous users to profiles, I created an ACL to give Edit permission to Everyone on this profile only. Seems to work. Playing with it little bit more to see if there are any other issues. Will let you know. Thanks anyway for reading this thread.

kdas

  • I post occasionally
  • **
  • Posts: 44
  • Karma: 0
Re: civimail - Mailing List Subscription
July 20, 2009, 08:31:53 pm
The profile approach that I mentioned may allow someone to abuse the system to add someone else email in the database. Is there any other approach where we can collect Firstname, Lastname apart form Email for Mailing list subscription?

kdas

  • I post occasionally
  • **
  • Posts: 44
  • Karma: 0
Re: civimail - Mailing List Subscription
May 28, 2010, 12:55:34 pm
It seems I tried above profile with Edit Profile permission to Everyone (that includes Anonymous) using civicrm 2.2 and the link worked for anonymous users. Today I tried the same using civicrm 3.1.3 and got the error. Tried a new profile from scratch and still got the same error even with ACL permission to Everyone. Is this a bug? I don't have old version of civicrm to try.

Sorry. A non-recoverable error has occurred.
The requested Profile (gid=19) is disabled OR it is not configured to be used for 'Profile' listings in its Settings OR there is no Profile with that ID OR you do not have permission to access this profile. Please contact the site administrator if you need assistance.

johns

  • I’m new here
  • *
  • Posts: 20
  • Karma: 1
    • Free Software Foundation
  • CiviCRM version: 4.3
  • CMS version: Drupal
Re: civimail - Mailing List Subscription
June 15, 2010, 01:06:19 pm
I'm also concerned about this. Any luck?
Support free software by supporting the Free Software Foundation: http://u.fsf.org/buildusup

Donald Lobo

  • Administrator
  • I’m (like) Lobo ;)
  • *****
  • Posts: 15963
  • Karma: 470
    • CiviCRM site
  • CiviCRM version: 4.2+
  • CMS version: Drupal 7, Joomla 2.5+
  • MySQL version: 5.5.x
  • PHP version: 5.4.x
Re: civimail - Mailing List Subscription
June 15, 2010, 04:47:12 pm

3.1 has introduced finer permissions to profiles

thus u can grant create/edit permission for anonymous users but not a listing, this prevents problems of exposing listings for profiles for anon users

you can also use acl's to have fine grained permissions on a per profile basis

lobo
A new CiviCRM Q&A resource needs YOUR help to get started. Visit our StackExchange proposed site, sign up and vote on 5 questions
Pages: [1]
  • CiviCRM Community Forums (archive) »
  • Old sections (read-only, deprecated) »
  • Support »
  • Using CiviCRM »
  • Using CiviMail (Moderator: Piotr Szotkowski) »
  • civimail - Mailing List Subscription

This forum was archived on 2017-11-26.