#213 e-mail command confirmations should be optional

[Daniel]

When we send an e-mail to change the member's
options with a command (e.g. to subscribe/unsubscribe
members), the confirmation of the commands should be
optionnal.

This is useful particularly if we do a php script that
sends the commands automatically from a post field.
Then the member doesn't need to see all those e-mail
commands.

This should be an optional command that would disable
these confirmations for the whole list and all commands.

www.Sympa.org mailing list does this very well.

Thank you.
Daniel

[moshe weitzman]

Logged In: YES
user_id=199362

I too need this. Thanks.

[Mark Sapiro]

Logged In: YES
user_id=1123998

In general, I think this is a bad idea because it allows
anyone to subscribe anyone else to a list by spoofing their
email address in an email command.

If you really want to open up subscribing without
confirmation, that feature is already available. Put

ALLOW_OPEN_SUBSCRIBE = Yes

in mm_cfg.py and lists will have a None option for
subscribe_policy which will allow subscribe without
confirmation.

[Mark Sapiro]

Logged In: YES
user_id=1123998

I'm moving this to "Feature Requests" as it is not a bug.

[Daniel]

Logged In: YES
user_id=1320890

Ok, thank you for that information, it works now.
I understand your concern, and allowing free subscriptions
from only certain hosts would be an idea of new feature
request. It's my case where it's always the server that send
an e-mail to mailman to subscribe people. It is a bit more
difficult for people to use my script by spoofing it, and I can
prevent more than 3 e-mails per day per IP address if really
needed.

[NancyS]

Logged In: YES
user_id=995718
Originator: NO

Yes, please. If the admin can subscribe an address without a confirmation, then they should also be able to change the address. Forcing kludges like unsubscribe the old address and subscribe a new one risks losing the changes that a subscriber may have made. [Yes, if they made changes, they should be expected to respond to the confirmation, but there's no way to tell if they are one of the subscribers that understands the web interface or not.]

[Mark Sapiro]

Logged In: YES
user_id=1123998
Originator: NO

Users should not be able to change their subscription address without confirmation unless the site has chosen to allow open subscribes and the list is so configured. Otherwise, anyone can maliciously subscribe anyone else by first subscribing themselves, confirming and then changing their address to the target.

What you (nes49) want is for an admin to be able to change a user's address without the user's confirmation. I agree with your reasoning, but that is not what this request is about. My 2005-11-03 comment was about user's subscribing without confirmation, but as I read this request today, I think it merely asks that the user be able to supress the "results of your email commands" informational email.

[Daniel]

Logged In: YES
user_id=1320890
Originator: YES

Hello, msapiro.

Yes, what I was requesting at first was that we would be able to choose to receive the informationnal confirmation or not.
If you have an external script which registers e-mail adresses, you don't want the user to receive the e-mail commands that you sent to accomplish this action (register/unregister), because the script did it and not himself, so he wouldn't understand a lot about this confirmation, and the goal is also to send a personnalised informationnal confirmation to each user instead of the standard one as we immediately see that Mailman is the e-mail manager.
Therefore I was surprised that there was no option to disable this informational confirmation to the user. Or else maybe there is one but I didn't find it at least.

Thanks