TOPIC:

When I logged in as the administrator today, I got an odd system notification saying that our VP Ed (for privacy's sake, I'm not listing his name here) "has added the following email address to your club email black list":

julianczarski%40outlook.com

I went to the Email and Contact Form page and indeed the above invalid email address has been entered in the email blacklist under the Email Security tab. This struck me as very bizarre because the VP Ed doesn't have access to the Email and Contact Form page. I asked him and he confirmed that he hadn't done anything and didn't know there was such a list.

Would you please advise as to why this has happened? Does it mean there's some vulnerability in your system that allows someone else to impersonate our VP Ed and made this bizarre entry? Or was this merely some odd result of some internal testing you've been doing.

I would be grateful for your advice.

Ottawa Toastmasters
Ottawatoastmasters.com
Club #1935

1. %40 is just another way to say @ %40 is a code for @... Although it is perfectly valid, it probably just means I need to make sure those codes get converted to actual characters... i will take care of that code change. Just make the data change in your blacklist. change the %40 to @

2. Your VPE had to have added that person to your black list as the system notification states--that is what would have triggered the automated notification. They did that by clicking a link in an email they received--e.g., via the "Is this SPAM?" links that are enabled for your club when you receive emails from non-members via public addresses. These are on by default... you can turn them off.

Also review: support.toastmastersclubs.org/4-general-...il-security-features
___________support.toastmastersclubs.org/doc/item/email-and-contact-forms

This is functionality that I put some effort into explaining and giving people an opportunity to weigh in on 5 months ago when it was introduced.

Thanks. It looks like he clicked on the link by mistake.