mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-05 19:11:00 +08:00
4c0367f774
# Problem When an admin sends a digest preview to an arbitrary email address, the email contained functional unsubscribe links belonging to the target user, allowing the recipient to unsubscribe that user without their consent. # Solution Pass `skip_unsubscribe_links: true` when generating preview digests, which skips `UnsubscribeKey` creation and suppresses unsubscribe content from both email headers and body templates at the source.
15 lines
No EOL
635 B
Text
15 lines
No EOL
635 B
Text
<%- site_link = raw(@markdown_linker.create(@site_name, '/')) %>
|
|
|
|
<%= raw(@markdown_linker.references) %>
|
|
|
|
<%= digest_custom_text("above_footer") %>
|
|
<%- if @unsubscribe_key %>
|
|
<%=raw(t :'user_notifications.digest.unsubscribe',
|
|
site_link: site_link,
|
|
email_preferences_link: raw(@markdown_linker.create(t('user_notifications.digest.your_email_settings'), '/my/preferences/emails')),
|
|
unsubscribe_link: raw(@markdown_linker.create(t('user_notifications.digest.click_here'), "/email/unsubscribe/#{@unsubscribe_key}"))) %>
|
|
<%- end %>
|
|
|
|
<%= raw(@markdown_linker.references) %>
|
|
|
|
<%= digest_custom_text("below_footer") %> |
