Prevent unwanted bypass of email verification

B

BxMail

New Member
Hi all,
i'm looking for a way to prevent a possible bypass of the email verification (list form custom redirect does not help).

When a user subscribes using POST to <endpoint>index.php/lists/<list-id>/subscribe
he is redirected to <endpoint>/index.php/lists/<list-id>/pending-subscribe/<subscriber-id>
and sees something like 'Please check your email address in order to confirm your subscription.'.
It is possible to use the <subscriber-id> to generate unwanted confirmed subscriptions by doing a request to
<endpoint>/index.php/lists/<list-id>/confirm-subscribe/<subscriber-id> (doing both calls by script etc.).
Is there an easy/build-in way to make mailwizz redirect to an path that does not contain <subscriber-id> on the pending-subscribe stage?
I tried using list form custom redirect but the <subscriber-id> is still revealed.
Best regards
 
Seems like too much work for such a small gain, I mean, what's the point, what do they try to achieve this way?
Regardless, we could potentially include a unique key in the confirmation link, this way this problem would go away.
We can include this starting with the next release if that's okay with you.
 
@BxMail - the confirmation key feature has been implemented today and it is going to undergo testing tomorrow and at the start of the next week, then if everything okay, we'll push it into the next update.
 
You must log in or register to reply here.
Back
Top