Don't reveal to the API the list of subscribers

This commit is contained in:
Lawrence Elitzer 2020-08-30 00:48:33 -05:00
parent e3c11476fb
commit 43837210ed

View file

@ -282,7 +282,9 @@ router.postAsync('/:cid/subscribe', passport.parseForm, corsOrCsrfProtection, as
if (existingSubscription && existingSubscription.status === SubscriptionStatus.SUBSCRIBED) {
await mailHelpers.sendAlreadySubscribed(req.locale, list, email, existingSubscription);
if (req.xhr) {
throw new Error(tUI('listEmailAddressAlreadyRegistered', req.locale, {list: list.name}));
return res.status(200).json({
msg: tUI('pleaseConfirmSubscription', req.locale)
});
}
res.redirect('/subscription/' + encodeURIComponent(req.params.cid) + '/confirm-subscription-notice');