subscribe page not checking if user already exists

[jsp254]

on my subscribe page it's not checking if the user already exists. instead, if i enter the info again, it updates the user.

what gives.

if i subscribe with this info:
name(at)domain.com - john - 90210 (required fields in my case)
then check the email and complete the subscription, in the users list i see this:
name(at)domain.com - john - 90210


now if i log out from the admin section and go to the subscribe page again and enter this info:
name(at)domain.com - roger - 51515
i should get a message saying the user already exists and see this if i check the users:
name(at)domain.com - john - 90210
but i'm not.

trying to resubscribe while the users already exists simply updates the existing users info. that's a potential liability waiting to happen.

if i went to the subscribe page and entered:
name(at)domain.com - imagoofyfoker - 69696
it would change the user to the above info.

that's is a good way to start problems!!!!



anyone else seen this yet

[Diar]

Read something about it yesterday, can't be bothered to find the forum post now.

Basically the response that person was is something along the lines of:

Phplist does this so users are able to update their preferences, if you don't want the email field there, edit the phpList code so it attaches a UID to the preferences link and takes away the email entry field.

Like I said, I can't be bothered to find the forum post, but it was something like that, posted by one of the more experienced users. (If I remember correctly, it was H2B2 posting it ^^)

[jsp254]

no. your missing my point. i'm not talking about the update page. i mean on the "register here for the newsletter" page.
the initial subscribe page: .../?p=subscribe&id=1

say a dad has registered with their family email address. he forgot to tell mom and she doesnt know. 4 days later, mom tries to register!!!

when she tries, it is supposed to pop up a message saying that email already exists, or already in database, or a similar message.

it's not doing that.

so when mom completes the form, it changes all of the information in the database to what ever she put in.

so next week when dad gets his newsletter, i'm refering to him as nancy or judy!!!! see the problem?

[Diar]

I didn't miss your point =]

I just wrote my explanation poorly.
In the other post they were actually talking about the subscription page aswell.

[Edit:] For some reason I remembered it wrong, too much info the past few weeks probably, constantly reading the forums is a bad thing

Anyways, here's the post I saw it on:
viewtopic.php?p=37424

[Edit2:] Might aswell include another link to a post, might be somewhat related to your problem aswell.
viewtopic.php?p=39299

[CS2]

I agree that this could be problematic. To prevent this, edit admin/subscribelib2.php. Search for the following text around line 160 (it will vary a bit depending on which version of PHPlist you're running):

Code: Select all

    # they do exist, so update the existing record
    # read the current values to compare changes

Immediately below that, add these lines:

Code: Select all

    if (isset($_GET['p']) && $_GET["p"] == "subscribe")
    {
      $msg = "A user with that email already exists.  Click <a href='".getConfig("preferencesurl").
             "'>this link</a> if you wish to update your personal information.";
      return;
    }

Basically, at the point we add the code, the script has already determined that this is an existing user. We're adding an additional check to determine if its the subscribe page. If it is, then we're informing the user that their email already exists in the database and providing them a link to the preferences page. I intentionally linked to the base preferences page without including their email or uniqid in order to force them to enter their email address again and a link to their preferences page will be emailed to them. This is a security measure against someone maliciously altering somebody else's information. However, you can make $msg be whatever you like. It will print the value of $msg to the screen and basically halt execution of the script, preventing the type of problem described by the original poster.

[jsp254]

OUTSTANDING!!!! that is what i needed. i looked at that section of the code over and over. the portion about the password threw me for a flip. i figured that was an area i need not mess with.

btw.... what is the area for the password below where i inserted this code? is this another option for users that i can assign, an area for future development, or something old and just not removed, or referenced from the admin section?

[CS2]

There's a setting in the config.php where you can require users to enter a password and login in order to change their preferences or unsubscribe. If that setting is enabled and they enter an email in the subscribe page that's already in the database, it will require them to login.

[amk]

I do not want my users to remember the password, and I consider the uid secure enough to provide the protection for their attributes.

I have applied the solution above, just used slightly updated code from below, that is normally used in case passwords are configured. And updated relevant strings in the language file.

Code: Select all

    if (isset($_GET['p']) && $_GET["p"] == "subscribe")
    {
        $msg = $GLOBALS["strUserExists"];
        $msg .= '<p>'.$GLOBALS["strUserExistsExplanationStart"].
          sprintf(' <a href="%s&email=%s">%s</a>',getConfig("preferencesurl"),$email,
          $GLOBALS["strUserExistsExplanationLink"]).
          $GLOBALS["strUserExistsExplanationEnd"];
      return;
      }


I do not like removal of the email address from link, instead addressed the underlaying problem also:
viewtopic.php?t=13525

[AppleJack]

Thanks CS2. I'm using this mod and think it will work pretty well in most cases, however it may cause some confusion to a small fraction of users. A situation could occur when a user who does not know he is on the blacklist tries to resubscribe, because he will incorrectly receive the message that says his email address already exists and that he must use his preferences page to make changes. A better message would say he is on the Blacklist.

Ideally, I think a user on the Blacklist should get a message that says "that email address is on the Blacklist," and a user not on the Blacklist should get the message that says "that email address already exists, please use your preferences panel if you want to make changes."

--Hope this is helpful.

[endjo]

Great solution CS2, Thanks a lot. Could You please tell me if there is some way to make the text A user with that email already exists. in RED color?

[H2B2]

Related mantis report: http://mantis.phplist.com/view.php?id=15557