Today we realized that anonymous users may subscribe to internal mailinglist groups in following scenario:
- We send a mass mailing to some internal groups which are not marked as public visible.
- A user receiving this mailing uses his/her mailer's "List unsubscribe" feature which utilizes the mail header "List unsubscribe"
- Civi sends a confirmation with an option to rollback the unsubscription for all groups the mailing addresses not only for those the user belongs to.
- Use this rollback fetaure and the user besomes a member of all groups used in the mailing :(
If this is the expected behaviour,
- the help text for mailing groups visibility should be changed, I think. Atm it's stating something like "Choose »users and administrators« if only authed users may add members to this group." And
- the groups have to be filtered to include only those, the recipoient is member of.
CiviCRM version 5.25.0
Does anybody know how to block those unauthed subscriptions?