Subscription workflow ( double opt-in via web interface )

I've been working with the mlm module lately for supporting multiple mailing lists on my site. First, way to go with this module!!! It's awesome for those who use ezmlm (since that's the only mailing list currently supported). After a few hours of learning I got it working perfectly.

For those trying to get it to work with ezmlm, you have to make sure you have mysql support compiled into your ezmlm binaries. You also have to make sure your default database connection in settings.php has the ['default'] setting. The mlm module uses it's own ezmlm-idx to read and write directly to the ezmlm db. This is way cool... HOWEVER.

Here is an issue I found with the code. Because the module reads/writes directly to/from the db, it bypasses the standard ezmlm verification process for anonymous users. What this means is, if the mlm node is published and accessible by anonymous users, ANYONE can go to that node then input ANY EMAIL ADDRESS AND HAVE IT AUTOMATICALLY SUBSCRIBED to the specified mailing list. Uh oh!!!!! Is it just me or is there some other way to prevent this?

Currently, the only way to avoid this is to use some type of node access control - and prevent anonymous users from submitting email addresses. Not my preferred option since it requires an additional module.

The preferred option is to modify the code and make the subscribe function in mlm.module follow standard mailing list subscription proceedures for anon users (e.g $user->uid == 0 then use mimemail to send a subscribe email to the list itself - not simply add the address to the db). This would be coded as a function call to the backend being used where the listname-subscribe@example.com email should be sent if the user is anonymous.

Since I'm working on my site and I just needed a quick fix, here is what I did to the mlm_subscribe () function in mlm.module

function mlm_subscribe($list, $mail, $type='subscriber', $notify=false, $batch=false) {
  if ($user->uid != 0) {
    if (is_array($mail) && !isset($mail['mail'])) {
      $res = true;
      foreach ($mail as $m) {
        $res = mlm_subscribe($list, $m, $type, $notify, true) && $res;
      }
      return $res;
    }

    if (is_object($mail)) $mail = $mail->mail;  // you can use an address or a $user object

    if ($res = mlm_backend_call($list->mlm_backend, 'subscribe', $list, $mail, $type)) {
      if (!$batch) {
        drupal_set_message(t('%mail subscribed to %list', array('%mail'=> $mail, '%list'=>$list->title)));
      }
      if ($notify && $body = $list->mlm_text->welcome) {
        mimemail(null, $mail, t('Subscribed to "%list"', array('%list'=>$list->title)), $body);
      }
    }
    return $res;
  
  }
  else {
    drupal_goto('node/1'); // you should use a variable_get of a user specified node
  }
}

When I get some more time I'll write a patch to ezmlm-idx.inc and mlm.module to send a subscribe email to the list rather than writing the email address to the db and sending out a confirmation email.

If this isn't a bug then please advise. From where I'm sitting right now, this is a security issue. Of course, since there is no official branch for this module, it may be an oversight.