Modify any subscription

[jhamilton09]

Before submitting your issue, please make sure that you've checked the checkboxes below.

• [ X ] I am running the latest release version of Cachet.
• [ X ] I am running at least PHP 5.5.9. You can check this by running php -v.
• [ X ] I have ran rm -rf bootstrap/cache/*.

What version of Cachet? 2.3.9
What database driver? MySQL? Postgres? SQLite? MySQL
What version of PHP? 7.0.3

Expected behaviour

Please describe what you're expecting to see happen.
Subscriptions should not be modified by anybody besides the subscriber.

Actual behaviour

Please describe what you're actually seeing happen.
Subscriptions can be modified by anybody that provides the email address. For an organization using Cachet, those email addresses may be predictable.

Steps to reproduce

If your issue requires any specific steps to reproduce, please outline them here.

1. Visit status page.
2. Click Subscribe button.
3. Provide email address of somebody else already subscribed.
4. You will receive the message 'Awesome. Cannot subscribe [email protected] because they're already subscribed.'.
5. Check or uncheck the components to subscribe/unsubscribe from.
6. Click the 'Update Subscription' button at the bottom.

Subscriptions will be updated accordingly.

[jbrooksuk]

I know it's not great, but a subscriber can click on the link included in the email to manage their subscription.

[jhamilton09]

Right. I think the subscriber should have to follow a link from their email in order to modify the subscriptions. They should not be able to modify the subscription by "re-subscribing" with a previously registered email address on the status page.

You should just receive the 'Cannot subscribe [email protected] because they're already subscribed.' and not the component list. Perhaps kick off an email to that person that prompts them to modify their subscriptions by following a link.

[jbrooksuk]

Oh, sorry:

Subscriptions can be modified by anybody that provides the email address. For an organization using Cachet, those email addresses may be predictable.

Yes, I agree that this is incorrect behaviour.

[jbrooksuk]

Not anymore you can't! :)

[Si-Richards]

I've got a regression on this bug....

What version of Cachet? 2.3.13
What database driver? MySQL? Postgres? SQLite? MySQL
What version of PHP? 7.1.20