benadida / helios-server

Helios server

Home Page:http://heliosvoting.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Sending email to non-existant voter_id sends email to all voters

Cryptosaurus opened this issue · comments

The voters/email page has an optional parameter voter_id to send an email to a single voter.
However, if the parameter given does not corresponds to an existing voter, it falls back to sending the mail to all voters. This is probably not what the user intended.

This can be triggers as follows:

  1. Create a test election with 2 or more voters, open the vote
  2. In a browser window, open the voter list, and click the link to send an email to voter 1
  3. In a second browser window, delete voter 1
  4. Validate the email in the first windows

Proposed fix: #380