[RFC] Mass HTML email option in ACP

Note: We are moving the topics of this forum and it will be deleted at some point

Publish your own request for comments/change or patches for the next version of phpBB. Discuss the contributions and proposals of others. Upcoming releases are 3.2/Rhea and 3.3.
Post Reply
User avatar
Kamahl19
Registered User
Posts: 161
Joined: Thu Dec 27, 2007 10:31 am

Re: [RFC] Mass HTML email option in ACP

Post by Kamahl19 »

I have to agree with keith. This could be part of phpBB ACP. It would be great, because now, I had to create a MOD which exports all email adresses to .txt file and then import this file to http://mailchimp.com which I use for sending nice html email.
Alien_Time
Registered User
Posts: 165
Joined: Fri Apr 05, 2013 3:38 am

Re: [RFC] Mass HTML email option in ACP

Post by Alien_Time »

Master_Cylinder wrote:Why wouldn't an admin want the user to be able to pick plain text delivery?
No one is disagreeing with that. Just because I am asking for an HTML email feature, doesnt mean the users has to be forced to only receive HTML email and never did I mention that on my request as well. It is ofcourse good to provide that options to the users and I dont disagree with that.

I can understand that you are clearly against this, but this doesnt mean HTML is pure evil. If admin wants to misuse or send out spams to their users, they are going to do this even without an HTML email feature. If you are so concerned about security and privacy, let me ask this, why does phpbb allow registration with email addresses? Isint that a security risk too since these admins can now get so many email address from these sign ups and can misuse it is so many different ways? So is phpbb NOT having this email registration feature because it could be a possible security / privacy risk? How many other info in profiles that user fills in that can be misused? Cant all of these info be misused by rogue admins too? Isint it making it easier for admins to distribute malicious payloads / virus / or whatever else there is / with all of these user's info at their disposal?
Master_Cylinder wrote:Why do you think, users at places like ESPN/CNN/etc can select to receive plain text or html?
First of all, doesnt it clearly mean that even big site like ESPN/CNN/etc.. send out emails in HTML too? If they are giving options to receive in plain text, that means they also send HTML emails since that is what some users prefer, isint it. If HTML is so insecure, then why is all website giants still using them? Even today I received an html email from google adsense publisher newsletter. Every day I receive tons of html emails from various BIG well reputed websites. So if HTML is such a bad practice that can harm their users, wouldnt these companies be aware of that? Then why they giving option for receiving HTML emails to their users?
Master_Cylinder wrote:How does a user know that they can trust the forum admin?
If they dont trust a website, would they even sign up in the first place? Users usually only sign up for a website when they like what they see and to stay upto date on whats happening there. If not, they dont even need to go through the effort of signing up. In return, as a site admin, it is also my responsibility / duty to give an update on whats happening on our website to my users. This is not mandatory but this is something some admins like to do and an HTML email is a useful tool to do that.

Its clear to me that you are against HTML email for whatever reasons, but that doesnt mean that this is a big security risk. Everything has a security risk and nothing is foolproof and I dont see why this is such a big deal. I wouldnt even request for this if this doesnt have any big use at all.
Alien_Time
Registered User
Posts: 165
Joined: Fri Apr 05, 2013 3:38 am

Re: [RFC] Mass HTML email option in ACP

Post by Alien_Time »

Kamahl19 wrote:I have to agree with keith. This could be part of phpBB ACP. It would be great, because now, I had to create a MOD which exports all email adresses to .txt file and then import this file to http://mailchimp.com which I use for sending nice html email.
Exactly right Kamahl. Its such a big effort to send html emails right now. At the moment, I have to manually go to phpbbmyadmin and download the email lists. Out of these lists, I also need to filter out users who have selected not to receive board emails in the UCP so I dont send these emails to them. And then I need to import them to my email client to send emails to them. I have to do this each time I send these emails. Also since there is a limitation on the number of emails that can be sent at a time, I spend 3-4 days sending these emails in batches. Its such a big effort. Having this in ACP is sooooo useful and also since ACP already has the email queue feature to auto send in batches, sending mass emails to all users or for users based on groups will be a hell of a lot easier. Thats why I think it will be a useful add-on to the core so board admins have this ability and possibility to send html emails directly from their board.
MaFeSa
Registered User
Posts: 69
Joined: Sun Aug 26, 2012 1:44 pm

Re: [RFC] Mass HTML email option in ACP

Post by MaFeSa »

+1
MyBB and many others can already do this!
User avatar
Mess
Registered User
Posts: 199
Joined: Wed Jun 13, 2012 10:14 am

Re: [RFC] Mass HTML email option in ACP

Post by Mess »

+1, I have needed this on several occasions.

But shouldnt this go in the ideas section on phpBB.com, or have you made a PR?
User avatar
Master_Cylinder
Registered User
Posts: 361
Joined: Wed Jul 31, 2013 9:54 pm

Re: [RFC] Mass HTML email option in ACP

Post by Master_Cylinder »

keith10456 wrote:
Master_Cylinder wrote:That's true but it's easier to send malicious payloads via html mail that plain text. Why make it easier for malicious admins, especially without giving the users the option of selecting plain text which is more secure? Why wouldn't an admin want the user to be able to pick plain text delivery?
If you have a malicious admin, having this feature is of no consequence because they will have the means, etc to email the member an html message anyway. Matter of fact, if you have a malicious admin they can install all kinds of scripts on the forum index so simply visiting the site will make a member a victim.
Master_Cylinder wrote:Why wouldn't an admin want the user to be able to pick plain text delivery?


If you check my post, I stated that the option of html/txt email should be added ;-)

Master_Cylinder wrote:How does a user know that they can trust the forum admin? Why do you think, users at places like ESPN/CNN/etc can select to receive plain text or html? Sure they could force the users into html but many of us don't want it and for good reasons. Why do you think so many people use disposable email addresses when they sign up for websites/forums/etc?
How does the user know they can trust the admin now?!

Currently, to email all of my members, I have to manually copy the email address of my members from my phpBB site and paste it into a separate newsletter program. Honestly speaking, in 2013 I shouldn't have to do that to send a notice to all of my members on my phpBB site. I believe this is a good idea/feature for phpBB admins. And again, yes, the option to receive the notice in text should be there (if its email and not PM/Notification).

You raised a good point but for the most part, if the admin is malicious he/she can do all of the things you're concerned about right now.
That's absolutely true a malicious admin could boobytrap his own forum but that would be detected and shut down much quicker than sending a HTML email with a fishing link to an alternate site to get the payload which then redirects back to the uninfected content. With .htaccess they can even redirect anti-virus sites to the non-infected content to make it harder to detect.

I didn't say that *you* didn't want a txt option added to the UCP, I asked why an admin (generic) wouldn't want it? When I first replied to this I suggested that the UCP option would be needed if implemented but I'd still vote no for html email at all. That is my opinion.

I doubt phpBB mass-emails were intended to be used as fancy newsletters so maybe this whole idea would be better as a newletter extension and keep the core a little more secure.

Like I said, *IF* the devs add this, there *should* be an UCP option to choose html/txt and ANY emails should be OPT-IN not opt-out.

That's my story and I'm sticking to it... :D
These kids today...
Buy them books, send them to school and what do they do?

They eat the paste. :lol:
Alien_Time
Registered User
Posts: 165
Joined: Fri Apr 05, 2013 3:38 am

Re: [RFC] Mass HTML email option in ACP

Post by Alien_Time »

Another reason I think why phpbb can have this feature is cuz phpbb has a huge potential and i use phpbb like a cms to run my whole website and not just the forum. I have also installed mediawiki and have this based on phpbb. I have seen so many sites using phpbb as the main and intalled it in root. Which means all members in these sites are using the member lists, etc.. registered through phpbb with a bridge to other installed cms. So therefore having an HTML email option makes more sense in phpbb since this is something that helps admin interacting with our users from Acp itself.

@Master_Cylinder: you have made your point and so do we. You seem to be so tied up with the so called "huge security risk". Seriously! Anyhow, I don't want this thread to be a long never ending discussion on this and it doesn't make any sense to me for this rfc. Yes there can be security risk if misused and so does a lot of other things which already exists in phpbb. I dont see this feature as big of a drama you make it to be. Good you have made your point that you don't vote for it. I will probably just leave it at that..

So anyone else other than Master_Cylinder?
User avatar
Pico88
Registered User
Posts: 73
Joined: Tue Apr 12, 2011 2:32 pm

Re: [RFC] Mass HTML email option in ACP

Post by Pico88 »

I'm against it. Imo the best solution for it is to creating an extension, which can replace acp mass email module and allow admins send emails with html code.

Meanwhile you can create the PR that allows to use html in e-mails.
keith10456
Registered User
Posts: 523
Joined: Sat Apr 22, 2006 10:29 pm
Contact:

Re: [RFC] Mass HTML email option in ACP

Post by keith10456 »

Couldn't the devs design it so the bbcode editor is used and when sent the bbcode is converted to HTML? I think that should suffice...
User avatar
Pony99CA
Registered User
Posts: 986
Joined: Sun Feb 08, 2009 2:35 am
Location: Hollister, CA
Contact:

Re: [RFC] Mass HTML email option in ACP

Post by Pony99CA »

keith10456 wrote:Couldn't the devs design it so the bbcode editor is used and when sent the bbcode is converted to HTML? I think that should suffice...
That does seem like a good compromise, but I don't have a problem with admins using HTML. They can already use it in Custom BBCodes (they pretty much have to).

There are other places that could use HTML, too, like ranks and forum titles, for example.

Steve
Silicon Valley Pocket PC (http://www.svpocketpc.com)
Creator of manage_bots and spoof_user (ask me)
Need hosting for a small forum with full cPanel & MySQL access? Contact me or PM me.
Post Reply