add.closed scenari can be cincumvented by owner through the web interface

[qosobrin]

Debian Stretch 9.4 and Sympa Package 6.2.16 environment.

I have a list configured with add.closed scenario:

title.gettext add impossible

true()   smtp,dkim,md5,smime -> reject('add_closed')

and subscribe.auth_owner scenario:

title.gettext requires authentication then owner approval

# subscription under owner control but previously email are checked by auth
true()                                     smtp,dkim      -> request_auth
is_subscriber([listname],[previous_email]) md5,smime -> do_it
true()                                     md5,smime -> owner

User A is the owner and user B is a non-member that requests subscription to the list. User A (the owner) receives the subscription request email and when he/she confirms it (via email) an error is generated telling him/her that it is not possible to perform the action because he/has insufficient permissions . But when user A (owner) confirms the subscription through the web interface it works and user B is added to the list.

Thank you very much. Regards.

[ikedas]

Hi @qosobrin,

Could you please check recent version of Sympa? Large amount of fixes and changes have been made after 6.2.16.

[qosobrin]

I have just checked 6.2.26 and the problem seems to be resolved. The list owner can moderate the subscription requests, but the only buttons available are "Toggle Selection" and "Reject selected addresses".

[ikedas]

@qosobrin, is status of the list "open"? If allow_subscribe_if_pending is off, subscriber cannot be added to closed/penging list.