mirror of
https://github.com/discourse/discourse.git
synced 2026-08-08 17:53:55 +08:00
4c0367f774# Problem When an admin sends a digest preview to an arbitrary email address, the email contained functional unsubscribe links belonging to the target user, allowing the recipient to unsubscribe that user without their consent. # Solution Pass `skip_unsubscribe_links: true` when generating preview digests, which skips `UnsubscribeKey` creation and suppresses unsubscribe content from both email headers and body templates at the source.
15 lines
No EOL
662 B
Text
Vendored
15 lines
No EOL
662 B
Text
Vendored
<table width="100%" class='summary-footer with-dir'>
|
|
<tr>
|
|
<!-- Empty cells pad either side of the email content -->
|
|
<td></td>
|
|
<td width="650" align="center">
|
|
<% if @unsubscribe_key %>
|
|
<%=raw(t 'user_notifications.digest.unsubscribe',
|
|
site_link: html_site_link,
|
|
email_preferences_link: link_to(t('user_notifications.digest.your_email_settings'), Discourse.base_url + '/my/preferences/emails'),
|
|
unsubscribe_link: link_to(t('user_notifications.digest.click_here'), "#{Discourse.base_url}/email/unsubscribe/#{@unsubscribe_key}")) %>
|
|
<% end %>
|
|
</td>
|
|
<td></td>
|
|
</tr>
|
|
</table> |
