Monday, November 14, 2016
1 change
Security fixes and vulnerability patches
Unsubscription links for mass mailings now include a secure token to prevent attackers from guessing link details and unsubscribing other people without permission. Old unsubscribe links will no longer work, but the change protects mailing lists and customer communication preferences.
Original PR description
Description of the issue/feature this PR addresses: Prevent brute force attacks that could perform unwanted unsubscriptions. Current behavior before PR: All parameters are plain text: mailing id, resource id and email. If you know the email, you can brute-force to get the ids and unsubscribe somebody. Desired behavior after PR is merged: A secure token is appended to the unsubscription URL, and access is denied if the incoming token does not match. Breaking change. This makes old URLs not work, that's why this patch goes to master. This is related to https://github.com/OCA/social/pull/58. ## I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr @Tecnativa