[Mailman-Users] Unsubscribe Using Web Form

[Mark Sapiro]

On 11/06/2014 09:42 AM, Greg Sims wrote:
> 
> I'm struggling with the Unsubscribe portion of the project.  I extended the
> webform but can't get it to work.  My goal is for our users to use the same
> web page to subscribe to and unsubscribe from the list with a minimum
> number of interactions.  I understand the need for the two stage
> subscription process with email confirmation -- this is required (and
> working).  I would like the Unsubscribe to be one click and done.
> 
> http://www.raystedman.org/daily-devotions/chinese-subscription


If you want immediate unsubscribe without confirmation, you need to
provide either the user's list password or the list admin password as
the value of the 'password' item in the form data.

Given what you are doing, you could just add

<input type="hidden" name="password" value="the_list_admin_password">

to the form, but this is a really bad idea as anyone can do what I did
and see this in the source of the page which exposes the list admin
password to the world.

A better idea is to post just the email address to your own script which
if invoked directly just displays some 'result' HTML and have that
script post to the options page or post to a list admin page to do the
unsubscribe. That way, you script can know the list admin password
without exposing it.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan