Access Denied For Anonymous Unsubscribe

OnlineWD - did you ever figure out this one?

On closer inspection it seems like the & in the unsubscribe link is the culprit

I found a typo on line 82 of notifications_anonymous.module -

if ((user_access('addminister notifications')

Not sure if that's related.

I'm personally having my own issue with even being able to allow someone to subscribe ( http://drupal.org/node/976110 ) so I can't test if that's the fix.

I had the same problem. In my case, I was using Mime Mailer and sending HTML mail. I was able to solve the problem by turning off both HTML filters for the Mime Mail method at admin/messaging/settings/method/filters

Obviously, this would not be appropriate if the text isn't filtered somewhere else. Seems that the unsubscribe instructions need to be appended after the filters are run, rather than before.

same problem here- subscribing

I'm having the same issue as well, and require anonymouse subcriptions with the ability to manage/unsubscribe.
--subscribing

edit: I can verify that changing the & in the url does fix the issue. If I find a fix, I'll post it here.

for me i have the following permissions enabled for anonymous users:

administer notifications
maintain own subscriptions
manage own subscriptions

and it works as expected.

Are you comfortable allowing anonymous users to administer the notification module? Or is it not really a risk?

good question - in my use case i was comfortable doing that only because of "security by anonymity" - meaning 99.9% of the visitors to the site would have no idea what the URL is to visit to administer notifications and I've removed it from the site's navigation.

That combined with my client's need to have anonymous subscriptions work NOW, resulted in enabling "administer notifications"... but as OnlineWD™ mentioned above, this is certainly NOT the ideal configuration...

It would be helpful to hear from the developer of this module exactly what "administer notifications" allows or if it'd be possible to fix this issue in a better way.

subscribing,

This is still an issue and I'd like a better solution than allowing anonymous management of the module

I get the Access Denied error when I click on the manage subscriptions link in the email (I get to the manage screen and when I click "drop" it gives me Access Denied). But not when I click unsubscribe - it unsubscribes me and sends me to the front page with a message of success. Using 4.x beta 7.

The following quick and dirty patch modifies messaging/includes/text.inc to remove the & from the URL. This works for cases where the final filter is set to "Plain text" in admin/messaging/settings/method/filters. You may need to configure your format filter to allow longer links (mine originally cropped at 72 chars before the content got to the final filter). I'm not sure why the filter fails in the first place since earlier in the function there's the following:

    $text = decode_entities($text);

My urls don't have a '&' in them but they don't work. Giving 'administer notifications' permission does work.