Body: <ol>
  <li>A CiviMAil bulk mail that was sent, it includes the unsubscribe token {action.unsubscribeUrl}.</li>
  <li>The recipient (recipient@abc.nodomain)receives that bulk email</li>
  <li>The recipient (recipient@abc.nodomain) of that bulk email forwards it to a friend (friend@xyz.nodomain)</li>
  <li>The friend (friend@xyz.nodomain) receives the forwarded bulk email, sees the possibility to unsubscribe.</li>
  <li>The friend (friend@xyz.nodomain) clicks on the unsubscribe link and is directed to a CiviCRM wrb page to confirm the unsubscribe action.  The web page states the email address as rec********** or the name as Rec****** and informs the friend &quot;If this is your email address and you wish to unsubscribe please click the Unsubscribe button to confirm.&quot;</li>
  <li>The friend ignores the partial email address or partial name and clicks on UNSUBSCRIBE.</li>
  <li>The recipient  (recipient@abc.nodomain) is removed from the mailing list group.</li>
  </ol>
  <p>I have tested this several times, and it happens every time. We do not want this to be possible.</p>
  <p>We are using  CiviCRM 5.69.5,running on Drupal 10</p>
  <p>Is there a way to prevent the recipient of a forwarded email from unsubscribing the original recipient of that email from the CiviCRM mailing list/group?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-03-25T15:40:57.223Z
Comments.Text: Possible option: instead of using the unsubscribe token, create a drupal webform (requiring authentication to access) for the mail group subscription and link to that form. Would this work for you?
Comments.UserDisplayName: zip
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-03-27T01:55:51.243Z
Comments.Text: Our newsletter webform does not require a user to create an account, so they have no login. We want to make it easy to subscribe to the newsletter. Requiring the user to have an account (in our case they would need to create an account) to authenticate themselves in order to un-subscribe is creating a stumbling block for un-subscribers. Most might give up.
Comments.UserDisplayName: EricLB
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-03-27T02:18:22.380Z
Comments.Text: I was hoping that there might be an easier way.
  For example, could there be a way for the un-subscriber be required to enter their own email address when un-subscribing? 
  That would prevent accidental un-subscribe actions from others, even if it would not prevent malicious unsubscribers.
Comments.UserDisplayName: EricLB
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-03-27T16:35:11.913Z
Comments.Text: I don't think there is going to be an easy way to do that exactly. I think the template that generates the unsubscribe page is at vendor/civicrm/civicrm-core/templates/CRM/Mailing/Form/Unsubscribe.tpl. You can probably create a new template that includes the information you want.
Comments.UserDisplayName: zip
Tags: <civimail><groups><tokens><unsubscribe>
Title: Recipient of forwarded bulk email can unsubscribe the original recipient from group
ThreadText: # Recipient of forwarded bulk email can unsubscribe the original recipient from group
  
  (Asked by: username_0 on 2024-02-17)
  
  1. A CiviMAil bulk mail that was sent, it includes the unsubscribe token {action.unsubscribeUrl}.
  2. The recipient (recipient@abc.nodomain)receives that bulk email
  3. The recipient (recipient@abc.nodomain) of that bulk email forwards it to a friend (friend@xyz.nodomain)
  4. The friend (friend@xyz.nodomain) receives the forwarded bulk email, sees the possibility to unsubscribe.
  5. The friend (friend@xyz.nodomain) clicks on the unsubscribe link and is directed to a CiviCRM wrb page to confirm the unsubscribe action. The web page states the email address as rec\*\*\*\*\*\*\*\*\*\* or the name as Rec\*\*\*\*\*\* and informs the friend "If this is your email address and you wish to unsubscribe please click the Unsubscribe button to confirm."
  6. The friend ignores the partial email address or partial name and clicks on UNSUBSCRIBE.
  7. The recipient (recipient@abc.nodomain) is removed from the mailing list group.
  
  I have tested this several times, and it happens every time. We do not want this to be possible.
  
  We are using CiviCRM 5.69.5,running on Drupal 10
  
  Is there a way to prevent the recipient of a forwarded email from unsubscribing the original recipient of that email from the CiviCRM mailing list/group?
  
  **Tags:** civimail, groups, tokens, unsubscribe
  
  > **Comments:**
  > **username_1**: Possible option: instead of using the unsubscribe token, create a drupal webform (requiring authentication to access) for the mail group subscription and link to that form. Would this work for you?  
  > **username_0**: Our newsletter webform does not require a user to create an account, so they have no login. We want to make it easy to subscribe to the newsletter. Requiring the user to have an account (in our case they would need to create an account) to authenticate themselves in order to un-subscribe is creating a stumbling block for un-subscribers. Most might give up.  
  > **username_0**: I was hoping that there might be an easier way. For example, could there be a way for the un-subscriber be required to enter their own email address when un-subscribing?  That would prevent accidental un-subscribe actions from others, even if it would not prevent malicious unsubscribers.  
  > **username_1**: I don't think there is going to be an easy way to do that exactly. I think the template that generates the unsubscribe page is at vendor/civicrm/civicrm-core/templates/CRM/Mailing/Form/Unsubscribe.tpl. You can probably create a new template that includes the information you want.  
  
  ---
  
  ## 0 answers
  
  