Issue: Subscriptions won't turn off

Simply visit the Subscribe tab and change your selection to "Do Not Subscribe" and the tab should disappear.

Regarding why the tab appears even if subscriptions are disabled:

To maintain compliancy with the CAN-SPAM Act of 2003, users who are already subscribed must be provided with a method to UNsubscribe.

If your subscription system is turned off, it does not accept new subscriptions. However, users who are already subscribed to a page will see the Subscribe tab for that page, for the only purpose of unsubscribing. If you visit the tab, you will see the only option is Do Not Subscribe (and the current selection to avoid confusion).

Similarly, if the user has any active subscriptions at all, they must still have access to the "My Subscriptions" page, for the sole purpose of being able to unsubscribe.

Even though your subscription system is currently turned off, if the user ever received a subscription notification in the past, they might not be aware that subscriptions are turned off now, and they have no way of knowing if you will ever re-enable subscriptions in the future (even if you don't plan to). If they cannot find an option to manage their existing subscription, they can technically report your site to the FCC for noncompliance.

Yes, I understand all of that about the subscription system, we have talked about that before. But I tested it from two different accounts that NEVER had any subscriptions. So there is some sort of a flaw there. Additionally, I was able to subscribe from a member type account even though subscriptions are turned off.

I see since you were looking in there that the Subscribe button is now gone from the main page, but it is still there on my index pages and I was able to subscribe to that as a regular member (I did that just a few minutes ago). So no, it is not turned off, something is still wrong.

And now some of my member groups have a report button but others do not.

A usergroup permission for reporting was added in Gamma 5. When Gamma 5 was installed, all usergroups were given permission to report content. However, if the usergroup had custom permissions for an area, note that report permissions were not given for any custom permissions sets.

Reporting permissions have not been modified internally since Gamma 5.

It is possible some of your users have not noticed that the Report button is actually part of the Options drop-down. If there would be nothing else under Options, then it just shows Report instead.

I do not even know what an options drop down is (well, I know what one is, but not in regards to the wiki).

Thanks, I did find that a few of the usergroup permissions were not set to Never.

I think there might be a flaw where if a user had "automatically subscribe me" settings in the UserCP (which might be turned on by default for new users), it would still auto-subscribe users whenever they edit a page or post a comment. I am looking into that now. I checked the database for some users that still see the tab without doing anything else first and it shows subscription rows for their user IDs, so it looks like this might be what happened.

As for being able to subscribe as a user that is not already subscribed. These users don't see the tab at all on that page. When I follow a direct link to the tab anyway, I don't get a permission error (which is good for reasons previously discussed), and I only see 1 option "Do Not Subscribe." If you see any other options, then that user got a subscription already somehow. I am trying to think of other ways that the setting might be circumvented, so that they can be fixed.

Either way, it does not raise any serious security problem. If the subscribe system is off, then emails should never send. The only thing the users are getting out of it is a page that lists what they might consider their own "favorite pages".

I made a small change which should prevent any more users from getting subscriptions randomly (the subscription will fail to save if they try to make a new one or the wiki does it).

Yes, they can. I did it as a test as a regular member. But when I went back in and unsubscribed, the tab did go away. There is something hinky in there.

NONE of my regular members are allowed to edit a page or post a comment and never have been. So that doesn't work in my case.

If you want, I will do a mass delete of all existing subscriptions. That should take care of any clean up, and give us a better idea of where there are options to create new subscriptions vs editing old ones.

I think the block I added should stop anything new, but just want to be sure that all the unwanted links get removed.

Yes, that would be great if you could do that please! Thanks!

Marking this as fixed for the next release.

After cleaning up the subscription database, I don't see any unexpected subscriptions for my test user.

I think the only spot on your install that is still affected is the "My Subscriptions" navbar link. This requires templates access to remove, which I don't have, but I have updated the upgrade script to remove it automatically in RC 4. Anyway, if users click on it, they will receive a permissions error as you expected for the tabs.

Now that no one has any subscriptions at all (after the database was cleaned), any user trying to visit the Subscribe tab directly (without clicking a link) gets a permissions error as you expected.

There is still the issue of the wiki trying to auto-subscribe users whenever they edit or post, but as I mentioned earlier, I added some code to block this before it saves, and it seems to be effective in my tests so far. I made quite a few changes for RC 4 which should prevent the wiki from trying to do this at all when subscriptions are disabled, but for now, the technique of blocking its attempts should be sufficient for your site.

Thanks!

I am curious that you say you "don't have access" to templates? But if you can just point me to which template it is in, I think I can remove it. That would be the best thing of all, for me, really.

The auto subscribe is certainly not a problem for me, because as I mentioned before, none of the regular membership has access to editing or posting, just my editors. And they know that subscribing to one of our articles is basically pointless.

(This is really off topic, but has anyone here had the problem of a member leaving your forums, changing their email address (or they have died so it is gone) and they have a lot of threads subscribed to that are getting bounced emails? I have several in this position and I don't know what to do about it other than signing in on their account. And I would never do that for someone who might come back and for the dead ones, we choose to leave their accounts untouched.)

We have that happen a lot actually. I just spent the last couple of days cleaning up another batch of those users.

What I do, is in the AdminCP's search for users function, I search for the bounced email address. Then in the user's settings, I turn off the following settings:
- Receive Admin Emails
- Receive Email from Other Users
- Send Notification Email When a Private Message is Received
You don't have to, but I like to change the user's primary group to "Users Awaiting Email Confirmation"

After that is saved, I edit the user again. In the Quick User Links drop-down, pick "Delete Subscriptions"

This doesn't remove any blog subscriptions or subscriptions for most add-ons. For that, you usually need the add-on "Admin Login as User" (unless you want to change the user's password so you can log in). When logged in as the user, visit the appropriate pages for My Subscriptions/Manage Subscriptions for each add-on, and Empty all their subscription folders.

Oh thank you, that makes perfect sense!