Unsubscription is identified by subscriber cid. This effectivelly allows only the recipient of the email to unsubscribe. This addresses issue #221.

I also scraped the "auto" parameter which automatically submits the unsubscription form when the link is clicked in a campaign email. Instead, I introduced the
unsubscription options ONE_STEP, ONE_STEP_WITH_FORM, TWO_STEP, TWO_STEP_WITH_FORM. The options without "_WITH_FORM" shall behave like when called with "auto".
This functionality is to come. Currently it behaves as ONE_STEP_WITH_FORM.

lib/models/lists.js

@@ -9,9 +9,11 @@ let tableHelpers = require('../table-helpers');
 
 const UnsubscriptionMode = {
     ONE_STEP: 0,
-    TWO_STEP: 1,
+    ONE_STEP_WITH_FORM: 1,
-    MANUAL: 2,
+    TWO_STEP: 2,
-    MAX: 3
+    TWO_STEP_WITH_FORM: 3,
+    MANUAL: 4,
+    MAX: 5
 };
 
 module.exports.UnsubscriptionMode = UnsubscriptionMode;

lib/models/subscriptions.js

@@ -107,84 +107,20 @@ module.exports.addConfirmation = (list, email, ip, data, callback) => {
                 return callback(null, false);
             }
 
-            fields.list(list.id, (err, fieldList) => {
+            if (data._skip) {
-                if (err) {
+                log.info('Subscription', 'Confirmation message for %s marked to be skipped (%s)', email, JSON.stringify(data));
-                    return callback(err);
+                return callback(null, cid);
-                }
+            }
 
-                let encryptionKeys = [];
+            // FIXME - customize from the router
-                fields.getRow(fieldList, data).forEach(field => {
+            const mailOpts = {
-                    if (field.type === 'gpg' && field.value) {
+                ignoreDisableConfirmations: true
-                        encryptionKeys.push(field.value.trim());
+            };
-                    }
+            const relativeUrls = {
-                });
+                confirmUrl: '/subscription/confirm/' + cid
-
+            };
-                settings.list(['defaultHomepage', 'defaultFrom', 'defaultAddress', 'defaultPostaddress', 'serviceUrl'], (err, configItems) => {
+            module.exports.sendMail(list, email, 'confirm-subscription', _('%s: Please Confirm Subscription'), relativeUrls, mailOpts, data, (err) => {
-                    if (err) {
+                return callback(err, cid);
-                        return callback(err);
-                    }
-
-                    setImmediate(() => {
-                        if (data._skip) {
-                            log.info('Subscription', 'Confirmation message for %s marked to be skipped (%s)', email, JSON.stringify(data));
-                            return;
-                        }
-
-                        // FIXME - move to router
-                        const mailOpts = {
-                            subject: _('%s: Please Confirm Subscription'),
-                            confirmUrlRoute: '/subscription/confirm/',
-                            templateType: 'subscription'
-                        };
-
-                        let sendMail = (html, text) => {
-                            mailer.sendMail({
-                                from: {
-                                    name: configItems.defaultFrom,
-                                    address: configItems.defaultAddress
-                                },
-                                to: {
-                                    name: [].concat(data.firstName || []).concat(data.lastName || []).join(' '),
-                                    address: email
-                                },
-                                subject: util.format(mailOpts.subject, list.name),
-                                encryptionKeys
-                            }, {
-                                html,
-                                text,
-                                data: {
-                                    title: list.name,
-                                    contactAddress: configItems.defaultAddress,
-                                    defaultPostaddress: configItems.defaultPostaddress,
-                                    confirmUrl: urllib.resolve(configItems.serviceUrl, mailOpts.confirmUrlRoute + cid)
-                                }
-                            }, err => {
-                                if (err) {
-                                    log.error('Subscription', err);
-                                }
-                            });
-                        };
-
-                        let text = {
-                            template: 'subscription/mail-confirm-' + mailOpts.templateType + '-text.hbs'
-                        };
-
-                        let html = {
-                            template: 'subscription/mail-confirm-' + mailOpts.templateType + '-html.mjml.hbs',
-                            layout: 'subscription/layout.mjml.hbs',
-                            type: 'mjml'
-                        };
-
-                        helpers.injectCustomFormTemplates(list.defaultForm, { text, html }, (err, tmpl) => {
-                            if (err) {
-                                return sendMail(html, text);
-                            }
-
-                            sendMail(tmpl.html, tmpl.text);
-                        });
-                    });
-                    return callback(null, cid);
-                });
             });
         });
     });
@@ -395,8 +331,6 @@ module.exports.insert = (listId, meta, subscription, callback) => {
                         queryArgs = values.concat(existing.id);
                         query = 'UPDATE `subscription__' + listId + '` SET ' + keys.map(key => '`' + key + '`=?') + ' WHERE id=? LIMIT 1';
                     }
-                    console.log(query);
-                    console.log(queryArgs);
 
                     connection.query(query, queryArgs, (err, result) => {
                         if (err) {
@@ -647,9 +581,8 @@ module.exports.update = (listId, cid, updates, allowEmail, callback) => {
     });
 };
 
-module.exports.unsubscribe = (listId, email, campaignId, callback) => {
+module.exports.unsubscribe = (listId, subscriberCid, campaignId, callback) => {
     listId = Number(listId) || 0;
-    email = (email || '').toString().trim();
 
     campaignId = (campaignId || '').toString().trim() || false;
 
@@ -657,8 +590,8 @@ module.exports.unsubscribe = (listId, email, campaignId, callback) => {
         return callback(new Error(_('Missing List ID')));
     }
 
-    if (!email) {
+    if (!subscriberCid) {
-        return callback(new Error(_('Missing email address')));
+        return callback(new Error(_('Missing subscriber cid')));
     }
 
     db.getConnection((err, connection) => {
@@ -666,7 +599,7 @@ module.exports.unsubscribe = (listId, email, campaignId, callback) => {
             return callback(err);
         }
 
-        connection.query('SELECT * FROM `subscription__' + listId + '` WHERE `email`=?', [email], (err, rows) => {
+        connection.query('SELECT * FROM `subscription__' + listId + '` WHERE `cid`=?', [subscriberCid], (err, rows) => {
             connection.release();
             if (err) {
                 return callback(err);
@@ -1166,92 +1099,86 @@ module.exports.updateAddress = (list, cid, updates, ip, callback) => {
 };
 
 
-module.exports.sendMail = (listId, email, template, subject, mailOpts, subscription, callback) => {
+module.exports.sendMail = (list, email, template, subject, relativeUrls, mailOpts, subscription, callback) => {
     db.getConnection((err, connection) => {
         if (err) {
             return callback(err);
         }
 
-        lists.get(listId, (err, list) => {
+        fields.list(list.id, (err, fieldList) => {
-            if (!err && !list) {
-                err = new Error(_('Selected list not found'));
-                err.status = 404;
-            }
-
             if (err) {
-                return next(err);
+                return callback(err);
             }
 
-            fields.list(list.id, (err, fieldList) => {
+            let encryptionKeys = [];
+            fields.getRow(fieldList, subscription).forEach(field => {
+                if (field.type === 'gpg' && field.value) {
+                    encryptionKeys.push(field.value.trim());
+                }
+            });
+
+            settings.list(['defaultHomepage', 'defaultFrom', 'defaultAddress', 'defaultPostaddress', 'serviceUrl', 'disableConfirmations'], (err, configItems) => {
                 if (err) {
                     return callback(err);
                 }
 
-                let encryptionKeys = [];
+                if (!mailOpts.ignoreDisableConfirmations && configItems.disableConfirmations) {
-                fields.getRow(fieldList, subscription).forEach(field => {
+                    return;
-                    if (field.type === 'gpg' && field.value) {
+                }
-                        encryptionKeys.push(field.value.trim());
-                    }
-                });
 
-                settings.list(['defaultHomepage', 'defaultFrom', 'defaultAddress', 'defaultPostaddress', 'serviceUrl'], (err, configItems) => {
+                const data = {
-                    if (err) {
+                    title: list.name,
-                        return callback(err);
+                    homepage: configItems.defaultHomepage || configItems.serviceUrl,
-                    }
+                    contactAddress: configItems.defaultAddress,
+                    defaultPostaddress: configItems.defaultPostaddress,
+                };
 
-                    const data = {
+                for (let relativeUrlKey in relativeUrls) {
-                        title: list.name,
+                    data[relativeUrlKey] = urllib.resolve(configItems.serviceUrl, relativeUrls[relativeUrlKey]);
-                        contactAddress: configItems.defaultAddress,
+                }
-                        defaultPostaddress: configItems.defaultPostaddress,
-                    };
 
-                    if (mailOpts.confirmUrlRoute) {
+                function sendMail(html, text) {
-                        data.confirmUrl = urllib.resolve(configItems.serviceUrl, mailOpts.confirmUrlRoute + cid)
+                    mailer.sendMail({
-                    }
+                        from: {
-
+                            name: configItems.defaultFrom,
-                    function sendMail(html, text) {
+                            address: configItems.defaultAddress
-                        mailer.sendMail({
+                        },
-                            from: {
+                        to: {
-                                name: configItems.defaultFrom,
+                            name: [].concat(subscription.firstName || []).concat(subscription.lastName || []).join(' '),
-                                address: configItems.defaultAddress
+                            address: email
-                            },
+                        },
-                            to: {
+                        subject: util.format(subject, list.name),
-                                name: [].concat(subscription.firstName || []).concat(subscription.lastName || []).join(' '),
+                        encryptionKeys
-                                address: email
+                    }, {
-                            },
+                        html,
-                            subject: util.format(subject, list.name),
+                        text,
-                            encryptionKeys
+                        data
-                        }, {
+                    }, err => {
-                            html,
-                            text,
-                            data
-                        }, err => {
-                            if (err) {
-                                log.error('Subscription', err);
-                            }
-                        });
-                    }
-
-                    let text = {
-                        template: 'subscription/mail-' + template + '-text.hbs'
-                    };
-
-                    let html = {
-                        template: 'subscription/mail-' + template + '-html.mjml.hbs',
-                        layout: 'subscription/layout.mjml.hbs',
-                        type: 'mjml'
-                    };
-
-                    helpers.injectCustomFormTemplates(list.defaultForm, { text, html }, (err, tmpl) => {
                         if (err) {
-                            return sendMail(html, text);
+                            log.error('Subscription', err);
                         }
-
-                        sendMail(tmpl.html, tmpl.text);
                     });
+                }
 
-                    return callback(null, cid);
+                let text = {
+                    template: 'subscription/mail-' + template + '-text.hbs'
+                };
+
+                let html = {
+                    template: 'subscription/mail-' + template + '-html.mjml.hbs',
+                    layout: 'subscription/layout.mjml.hbs',
+                    type: 'mjml'
+                };
+
+                helpers.injectCustomFormTemplates(list.defaultForm, { text, html }, (err, tmpl) => {
+                    if (err) {
+                        return sendMail(html, text);
+                    }
+
+                    sendMail(tmpl.html, tmpl.text);
                 });
+
+                return callback();
             });
         });
     });

lib/tools.js

@@ -181,7 +181,7 @@ function validateEmail(address, checkBlocked, callback) {
 
 function getMessageLinks(serviceUrl, campaign, list, subscription) {
     return {
-        LINK_UNSUBSCRIBE: urllib.resolve(serviceUrl, '/subscription/' + list.cid + '/unsubscribe/' + subscription.cid + '?auto=yes&c=' + campaign.cid),
+        LINK_UNSUBSCRIBE: urllib.resolve(serviceUrl, '/subscription/' + list.cid + '/unsubscribe/' + subscription.cid + '?c=' + campaign.cid),
         LINK_PREFERENCES: urllib.resolve(serviceUrl, '/subscription/' + list.cid + '/manage/' + subscription.cid),
         LINK_BROWSER: urllib.resolve(serviceUrl, '/archive/' + campaign.cid + '/' + list.cid + '/' + subscription.cid),
         CAMPAIGN_ID: campaign.cid,

routes/lists.js

@@ -784,12 +784,24 @@ function getUnsubscriptionModeOptions(unsubscriptionMode) {
         label: _('One-step (i.e. no email with confirmation link)')
     };
 
+    options[lists.UnsubscriptionMode.ONE_STEP_WITH_FORM] = {
+        value: lists.UnsubscriptionMode.ONE_STEP_WITH_FORM,
+        selected: unsubscriptionMode === lists.UnsubscriptionMode.ONE_STEP_WITH_FORM,
+        label: _('One-step with unsubscription form (i.e. no email with confirmation link)')
+    };
+
     options[lists.UnsubscriptionMode.TWO_STEP] = {
         value: lists.UnsubscriptionMode.TWO_STEP,
         selected: unsubscriptionMode === lists.UnsubscriptionMode.TWO_STEP,
         label: _('Two-step (i.e. an email with confirmation link will be sent)')
     };
 
+    options[lists.UnsubscriptionMode.TWO_STEP_WITH_FORM] = {
+        value: lists.UnsubscriptionMode.TWO_STEP_WITH_FORM,
+        selected: unsubscriptionMode === lists.UnsubscriptionMode.TWO_STEP_WITH_FORM,
+        label: _('Two-step with unsubscription form (i.e. an email with confirmation link will be sent)')
+    };
+
     options[lists.UnsubscriptionMode.MANUAL] = {
         value: lists.UnsubscriptionMode.MANUAL,
         selected: unsubscriptionMode === lists.UnsubscriptionMode.MANUAL,

routes/subscription.js

@@ -65,80 +65,23 @@ router.get('/confirm/:cid', (req, res, next) => {
                 return next(err);
             }
 
-            settings.list(['defaultHomepage', 'serviceUrl', 'pgpPrivateKey', 'defaultAddress', 'defaultPostaddress', 'defaultFrom', 'disableConfirmations'], (err, configItems) => {
+            // FIXME - differentiate email based on action
-                if (err) {
-                    return next(err);
-                }
 
-                // FIXME - split decision based on action
+            const relativeUrls = {
+                preferencesUrl: '/subscription/' + list.cid + '/manage/' + subscription.cid,
+                unsubscribeUrl: '/subscription/' + list.cid + '/unsubscribe/' + subscription.cid
+            };
+
+            subscriptions.sendMail(list, subscription.email, 'subscription-confirmed', _('%s: Subscription Confirmed'), relativeUrls, {}, subscription, (err) => {
+                if (err) {
+                    req.flash('danger', err.message || err);
+                    log.error('Subscription', err);
+                    return res.redirect('/subscription/' + encodeURIComponent(req.params.lcid) + '/unsubscribe/' + encodeURIComponent(req.body.cid) + '?' + tools.queryParams(req.body));
+                }
 
                 res.redirect('/subscription/' + list.cid + '/subscribed-notice');
-
-                if (configItems.disableConfirmations) {
-                    return;
-                }
-
-                fields.list(list.id, (err, fieldList) => {
-                    if (err) {
-                        return log.error('Fields', err);
-                    }
-
-                    let encryptionKeys = [];
-                    fields.getRow(fieldList, subscription).forEach(field => {
-                        if (field.type === 'gpg' && field.value) {
-                            encryptionKeys.push(field.value.trim());
-                        }
-                    });
-
-                    let sendMail = (html, text) => {
-                        mailer.sendMail({
-                            from: {
-                                name: configItems.defaultFrom,
-                                address: configItems.defaultAddress
-                            },
-                            to: {
-                                name: [].concat(subscription.firstName || []).concat(subscription.lastName || []).join(' '),
-                                address: subscription.email
-                            },
-                            subject: util.format(_('%s: Subscription Confirmed'), list.name),
-                            encryptionKeys
-                        }, {
-                            html,
-                            text,
-                            data: {
-                                title: list.name,
-                                homepage: configItems.defaultHomepage || configItems.serviceUrl,
-                                contactAddress: configItems.defaultAddress,
-                                defaultPostaddress: configItems.defaultPostaddress,
-                                preferencesUrl: urllib.resolve(configItems.serviceUrl, '/subscription/' + list.cid + '/manage/' + subscription.cid),
-                                unsubscribeUrl: urllib.resolve(configItems.serviceUrl, '/subscription/' + list.cid + '/unsubscribe/' + subscription.cid)
-                            }
-                        }, err => {
-                            if (err) {
-                                log.error('Subscription', err);
-                            }
-                        });
-                    };
-
-                    let text = {
-                        template: 'subscription/mail-subscription-confirmed-text.hbs'
-                    };
-
-                    let html = {
-                        template: 'subscription/mail-subscription-confirmed-html.mjml.hbs',
-                        layout: 'subscription/layout.mjml.hbs',
-                        type: 'mjml'
-                    };
-
-                    helpers.injectCustomFormTemplates(req.query.fid || list.defaultForm, { text, html }, (err, tmpl) => {
-                        if (err) {
-                            return sendMail(html, text);
-                        }
-
-                        sendMail(tmpl.html, tmpl.text);
-                    });
-                });
             });
+
         });
     });
 });
@@ -159,6 +102,8 @@ router.get('/:cid', passport.csrfProtection, (req, res, next) => {
             return next(err);
         }
 
+        // FIXME: process subscriber cid param for resubscription requests
+
         let data = tools.convertKeys(req.query, {
             skip: ['layout']
         });
@@ -561,6 +506,8 @@ router.post('/:lcid/manage-address', passport.parseForm, passport.csrfProtection
 });
 
 router.get('/:lcid/unsubscribe/:ucid', passport.csrfProtection, (req, res, next) => {
+    // FIXME: handle different subscription options. The one below is currently "One-step with unsubscribe form"
+
     lists.getByCid(req.params.lcid, (err, list) => {
         if (!err && !list) {
             err = new Error(_('Selected list not found'));
@@ -587,9 +534,9 @@ router.get('/:lcid/unsubscribe/:ucid', passport.csrfProtection, (req, res, next)
                 }
 
                 subscription.lcid = req.params.lcid;
+                subscription.ucid = req.params.ucid;
                 subscription.title = list.name;
                 subscription.csrfToken = req.csrfToken();
-                subscription.autosubmit = !!req.query.auto;
                 subscription.campaign = req.query.c;
                 subscription.defaultAddress = configItems.defaultAddress;
                 subscription.defaultPostaddress = configItems.defaultPostaddress;
@@ -636,83 +583,24 @@ router.post('/:lcid/unsubscribe', passport.parseForm, passport.csrfProtection, (
             return next(err);
         }
 
-        let email = req.body.email;
+        subscriptions.unsubscribe(list.id, req.body.ucid, req.body.campaign, (err, subscription) => {
-
-        subscriptions.unsubscribe(list.id, email, req.body.campaign, (err, subscription) => {
             if (err) {
                 req.flash('danger', err.message || err);
                 log.error('Subscription', err);
-                return res.redirect('/subscription/' + encodeURIComponent(req.params.lcid) + '/unsubscribe/' + encodeURIComponent(req.body.cid) + '?' + tools.queryParams(req.body));
+                return res.redirect('/subscription/' + encodeURIComponent(req.params.lcid) + '/unsubscribe/' + encodeURIComponent(req.body.ucid) + '?' + tools.queryParams(req.body));
             }
-            res.redirect('/subscription/' + req.params.lcid + '/unsubscribed-notice');
 
-            fields.list(list.id, (err, fieldList) => {
+            const relativeUrls = {
+                subscribeUrl: '/subscription/' + list.cid + '?cid=' + subscription.cid
+            };
+            subscriptions.sendMail(list, subscription.email, 'unsubscription-confirmed', _('%s: Unsubscribe Confirmed'), relativeUrls, {}, subscription, (err) => {
                 if (err) {
-                    return log.error('Fields', err);
+                    req.flash('danger', err.message || err);
+                    log.error('Subscription', err);
+                    return res.redirect('/subscription/' + encodeURIComponent(list.cid) + '/unsubscribe/' + encodeURIComponent(subscription.cid) + '?' + tools.queryParams(req.body));
                 }
 
-                let encryptionKeys = [];
+                res.redirect('/subscription/' + req.params.lcid + '/unsubscribed-notice');
-                fields.getRow(fieldList, subscription).forEach(field => {
-                    if (field.type === 'gpg' && field.value) {
-                        encryptionKeys.push(field.value.trim());
-                    }
-                });
-
-                settings.list(['defaultHomepage', 'defaultFrom', 'defaultAddress', 'defaultPostaddress', 'serviceUrl', 'disableConfirmations'], (err, configItems) => {
-                    if (err) {
-                        return log.error('Settings', err);
-                    }
-
-                    if (configItems.disableConfirmations) {
-                        return;
-                    }
-
-                    let sendMail = (html, text) => {
-                        mailer.sendMail({
-                            from: {
-                                name: configItems.defaultFrom,
-                                address: configItems.defaultAddress
-                            },
-                            to: {
-                                name: [].concat(subscription.firstName || []).concat(subscription.lastName || []).join(' '),
-                                address: subscription.email
-                            },
-                            subject: util.format(_('%s: Unsubscribe Confirmed'), list.name),
-                            encryptionKeys
-                        }, {
-                            html,
-                            text,
-                            data: {
-                                title: list.name,
-                                contactAddress: configItems.defaultAddress,
-                                defaultPostaddress: configItems.defaultPostaddress,
-                                subscribeUrl: urllib.resolve(configItems.serviceUrl, '/subscription/' + list.cid + '?cid=' + subscription.cid)
-                            }
-                        }, err => {
-                            if (err) {
-                                log.error('Subscription', err);
-                            }
-                        });
-                    };
-
-                    let text = {
-                        template: 'subscription/mail-unsubscription-confirmed-text.hbs'
-                    };
-
-                    let html = {
-                        template: 'subscription/mail-unsubscription-confirmed-html.mjml.hbs',
-                        layout: 'subscription/layout.mjml.hbs',
-                        type: 'mjml'
-                    };
-
-                    helpers.injectCustomFormTemplates(req.query.fid || list.defaultForm, { text, html }, (err, tmpl) => {
-                        if (err) {
-                            return sendMail(html, text);
-                        }
-
-                        sendMail(tmpl.html, tmpl.text);
-                    });
-                });
             });
         });
     });

services/sender.js

@@ -418,7 +418,7 @@ function formatMessage(message, callback) {
                                         }
                                     },
                                     list: {
-                                        unsubscribe: url.resolve(configItems.serviceUrl, '/subscription/' + list.cid + '/unsubscribe/' + message.subscription.cid + '?auto=yes')
+                                        unsubscribe: url.resolve(configItems.serviceUrl, '/subscription/' + list.cid + '/unsubscribe/' + message.subscription.cid)
                                     },
                                     subject: tools.formatMessage(configItems.serviceUrl, campaign, list, message.subscription, campaign.subject),
                                     html: renderedHtml,

views/subscription/partials/subscription-unsubscribe-form.hbs

@@ -1,20 +1,13 @@
 <form method="post" id="main-form" action="/subscription/{{lcid}}/unsubscribe">
     <input type="hidden" name="_csrf" value="{{csrfToken}}">
     <input type="hidden" name="campaign" value="{{campaign}}">
-    <input type="hidden" name="cid" value="{{cid}}">
+    <input type="hidden" name="ucid" value="{{ucid}}">
 
     <div class="form-group">
         <label for="email">{{#translate}}Email address{{/translate}}</label>
-        <input type="email" name="email" id="email" placeholder="" value="{{email}}" autofocus required>
+        <input type="email" name="email" id="email" placeholder="" value="{{email}}" readonly>
     </div>
 
     <button type="submit" style="position: absolute; top: -9999px; left: -9999px;">{{#translate}}Unsubscribe{{/translate}}</button>
 </form>
 
-{{#if email}}
-    {{#if autosubmit}}
-        <script>
-            document.getElementById('main-form').submit();
-        </script>
-    {{/if}}
-{{/if}}

views/subscription/web-unsubscribe.mjml.hbs

@@ -3,9 +3,6 @@
         <mj-text mj-class="h3">
             {{#translate}}Unsubscribe{{/translate}}
         </mj-text>
-        <mj-text mj-class="p">
-            {{#translate}}Enter your email address to unsubscribe from:{{/translate}} {{title}}
-        </mj-text>
         <mj-text>
             {{> subscription_unsubscribe_form}}
         </mj-text>