Thread

Hi,

I encounter a problem with the /index.php?ACT=2&id=xxx unsubscribe link.

Anyone can build a script to hit all unsubscribe links form 1 to ‘n’ so all subscriptions will be deleted instantly, this gives me a quite uncomfortable feeling. Is it posible to convert the id into a hash like md5 to secure this problem? Hit a switch somewhere in the Control Panel?

Frank

The id there is pulling from the authorization code, which would be difficult to match.  For example:

To remove your email from the "testing" mailing list, click here:

<a href="http://media-cow.com/?ACT=5&id=BHmJF2JyIQ">http://media-cow.com/?ACT=5&id=BHmJF2JyIQ</a>

If you’d like, I can pull up how it’s generated.  But it would take a serious attack to hit all permutations. 

That ease your mind, or you want to delve into it a bit more.

hmm, i’m using EE 1.6.4 upgraded from version 1.6.1 and before 1.5 etc. and (still) get sequential numbers for id’s. like id=321 and id=322, that’s very easy to attack!

Do i have to flip a switch somewhere to switch the ‘encode’ feature on or change the datatype of a database field in order to get this to work?

Frank

Is this the unsubscribe link for the mailing list?  I may be looking in the wrong spot.  But if it’s elsewhere and pure id, it’s likely you have to be the logged in member or something.  But- just depends.  How do you access the link in question?