Links like this in the email notifications sent by watcher are not working for me:

To stop receiving notifications of updates to just this post, click the link below:
http://www/user/2/watcher/toggle/8892?token=f28e254a577a3011fcf8ac51ab1805d7

Instead users get a message saying "You've followed an invalid link."

I looked through the code and it seems the only explanation is that the token part of the querystring is invalid.

drupal_get_token() uses session_id(). What if the user who receives an email has a different session_id from when the message was sent? In fact this should almost always be the case, because the session that sends the messages should be another user's session when they add a comment or a cronjob's session. How can this token ever match unless the user that receives the email is the one that causes it to be sent? Or am I missing something fundamental (apologies if so)?

Comments

ibaal’s picture

ibaal commented

I have the same problem. My fix was commenting out the token-check in server side code for the moment (watcher.module, lines [1599-1603]).

I might be missing something on drupal and sessions, but wouldn't a session time out eventually anyways? and give a new session_id?

Now, could someone please explain to me what the module is trying to achieve with using a token in the url? and how the token actually helps achieving this goal?

mr.j’s picture

mr.j commented

Be careful disabling that code. I believe the token was introduced to protect against a XSS & CSRF security vulnerability that was discovered in the module.
http://drupal.org/node/955282

But as we know it has also broken the unsubscribe feature. I guess you have to weigh up how likely it is that someone will try to fool one of your users into disabling the watching of a post on the site, and how damaging you think that could be.

To fix the problem, Watcher needs to generate its own secure token without using a session id, because it will never work that way. I thought of appending the user's uid or hashed password to the site's salt string from settings.php and hashing them together to use as a token. You can't put a random salt string in the module because its open source and it would be easy to find it - at least the site's salt string is or should be unique to every site. But I am no security expert so don't know if it would be suitable.

skizzo’s picture

skizzo commented

watching

Ela’s picture

Ela commented

watching

scalp’s picture

scalp commented

watching

j9’s picture

j9 commented

watching

Tony_Deep’s picture

Tony_Deep commented

watching