Fix: Disable feature by default. Need option MAIN_SOCIETE_UNSUBSCRIBE to

enable because feature is a security hole.

htdocs/comm/mailing/fiche.php

@@ -47,8 +47,6 @@ $object=new Mailing($db);
 $substitutionarray=array(
 '__ID__' => 'IdRecord',
 '__EMAIL__' => 'EMail',
-'__CHECK_READ__' => 'CheckMail',
-'__UNSUSCRIBE__' => 'Unsuscribe',
 '__LASTNAME__' => 'Lastname',
 '__FIRSTNAME__' => 'Firstname',
 '__OTHER1__' => 'Other1',
@@ -59,11 +57,20 @@ $substitutionarray=array(
 '__SIGNATURE__' => 'Signature',
 '__PERSONALIZED__' => 'Personalized'
 );
+if ($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)
+{
+    $substitutionarray=array_merge(
+        $substitutionarray,
+        array(
+			'__CHECK_READ__' => 'CheckMail',
+			'__UNSUSCRIBE__' => 'Unsuscribe'
+	        )
+    );
+}
+
 $substitutionarrayfortest=array(
 '__ID__' => 'TESTIdRecord',
 '__EMAIL__' => 'TESTEMail',
-'__CHECK_READ__' => 'TESTCheckMail',
-'__UNSUSCRIBE__' => 'TESTUnsuscribe',
 '__LASTNAME__' => 'TESTLastname',
 '__FIRSTNAME__' => 'TESTFirstname',
 '__OTHER1__' => 'TESTOther1',
@@ -74,7 +81,16 @@ $substitutionarrayfortest=array(
 '__SIGNATURE__' => 'TESTSignature',
 '__PERSONALIZED__' => 'TESTPersonalized'
 );
-
+if ($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)
+{
+    $substitutionarray=array_merge(
+    $substitutionarray,
+    array(
+			'__CHECK_READ__' => 'TESTCheckMail',
+			'__UNSUSCRIBE__' => 'TESTCheckMail'
+    )
+    );
+}
 
 // Action clone object
 if ($action == 'confirm_clone' && $confirm == 'yes')
@@ -191,9 +207,9 @@ if ($action == 'sendallconfirmed' && $confirm == 'yes')
                     $tmpfield=explode('=',$other[4],2); $other5=(isset($tmpfield[1])?$tmpfield[1]:$tmpfield[0]);
 					$substitutionarray=array(
 						'__ID__' => $obj->source_id,
-						'__EMAIL__' => '<a href="mailto:'.$obj->email.'">'.$obj->email.'</a>',
+						'__EMAIL__' => $obj->email,
-						'__CHECK_READ__' => '<img src="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-read.php?tag='.$obj->tag.'" width="0" height="0" style="width:0px;height:0px" border="0"/>',
+					    '__CHECK_READ__' => '<img src="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-read.php?tag='.$obj->tag.'" width="0" height="0" style="width:0px;height:0px" border="0"/>',
-						'__UNSUSCRIBE__' => '<a href="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-usubscribe.php?tag='.$obj->tag.'&unsuscrib=1" target="_blank">'.$langs->trans("MailUnsubcribe").'</a>',
+					    '__UNSUSCRIBE__' => '<a href="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-unsubscribe.php?tag='.$obj->tag.'&unsuscrib=1" target="_blank">'.$langs->trans("MailUnsubcribe").'</a>',
 						'__LASTNAME__' => $obj->nom,
 						'__FIRSTNAME__' => $obj->prenom,
 						'__OTHER1__' => $other1,
@@ -1027,8 +1043,11 @@ else
 			print '<br><i>'.$langs->trans("CommonSubstitutions").':<br>';
 			print '__ID__ = '.$langs->trans("IdRecord").'<br>';
 			print '__EMAIL__ = '.$langs->trans("EMail").'<br>';
-			print '__CHECK_READ__ = '.$langs->trans("CheckRead").'<br>';
+            if ($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)
-			print '__UNSUSCRIBE__ = '.$langs->trans("MailUnsubcribe").'<br>';
+            {
+    			print '__CHECK_READ__ = '.$langs->trans("CheckRead").'<br>';
+	    		print '__UNSUSCRIBE__ = '.$langs->trans("MailUnsubcribe").'<br>';
+            }
 			print '__LASTNAME__ = '.$langs->trans("Lastname").'<br>';
 			print '__FIRSTNAME__ = '.$langs->trans("Firstname").'<br>';
 			print '__OTHER1__ = '.$langs->trans("Other").'1<br>';

htdocs/public/emailing/mailing-read.php

@@ -32,6 +32,12 @@ require("../../main.inc.php");
 
 $id=GETPOST('tag');
 
+if (empty($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)) accessforbidden('Option not enabled');
+
+
+/*
+ * Actions
+ */
 
 if ($id!='')
 {
@@ -55,8 +61,5 @@ if ($id!='')
 
 }
 
-
-
-
 $db->close();
 ?>

htdocs/public/emailing/mailing-usubscribe.php

@@ -20,7 +20,7 @@
 
 
 /**
- *      \file       scripts/emailings/mailing-usubscribe.php
+ *      \file       scripts/emailings/mailing-unsubscribe.php
  *      \ingroup    mailing
  *      \brief      Script use to update unsubcribe contact to prospect mailing list
  */
@@ -39,13 +39,19 @@ $langs->load("mails");
 $id=GETPOST('tag');
 $unsuscrib=GETPOST('unsuscrib');
 
+if (empty($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)) accessforbidden('Option not enabled');
+
+
+/*
+ * Actions
+ */
 
 if (($id!='') && ($unsuscrib=='1'))
 {
 	//Udate status of mail in Destinaries maling list
 	$statut='3';
 	$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles SET statut=".$statut." WHERE tag='".$id."'";
-	dol_syslog("public/emailing/mailing-usubscribe.php : Mail unsubcribe : ".$sql, LOG_DEBUG);
+	dol_syslog("public/emailing/mailing-unsubscribe.php : Mail unsubcribe : ".$sql, LOG_DEBUG);
 
 	$resql=$db->query($sql);
 
@@ -92,8 +98,6 @@ if (($id!='') && ($unsuscrib=='1'))
 	print '</td></tr></table>';
 	print "</body>\n";
 	print "</html>\n";
-	
-
 }
 
 $db->close();

scripts/emailings/mailing-send.php

@@ -106,8 +106,11 @@ if ($resql)
 	{
 		dol_syslog("nb of targets = ".$num, LOG_DEBUG);
 
+		$now=dol_now();
+
 		// Positionne date debut envoi
-		$sql="UPDATE ".MAIN_DB_PREFIX."mailing SET date_envoi=SYSDATE() WHERE rowid=".$id;
+		$sql="UPDATE ".MAIN_DB_PREFIX."mailing SET date_envoi='".$db->idate($now)."' WHERE rowid=".$id;
+
 		$resql2=$db->query($sql);
 		if (! $resql2)
 		{
@@ -135,9 +138,9 @@ if ($resql)
 			$other5=$other[4];
 			$substitutionarray=array(
 				'__ID__' => $obj->source_id,
-				'__EMAIL__' => '<a href="mailto:'.$obj->email.'">'.$obj->email.'</a>',
+				'__EMAIL__' => $obj->email,
 				'__CHECK_READ__' => '<img src="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-read.php?tag='.$obj->tag.'" width="0" height="0" style="width:0px;height:0px" border="0"/>',
-				'__UNSUSCRIBE__' => '<a href="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-usubscribe.php?tag='.$obj->tag.'&unsuscrib=1" target="_blank">'.$langs->trans("MailUnsubcribe").'</a>',
+				'__UNSUSCRIBE__' => '<a href="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-unsubscribe.php?tag='.$obj->tag.'&unsuscrib=1" target="_blank">'.$langs->trans("MailUnsubcribe").'</a>',
 				'__LASTNAME__' => $obj->lastname,
 				'__FIRSTNAME__' => $obj->firstname,
 				'__OTHER1__' => $other1,