When using "Use single form subscription page" - User email leaks into the default text of "E-mail address" in subscribe.html for all sessions after user manages subscription

This is happening in your Varnish or whatever reverse proxy you have set up to do caching. I assume that it should be enough to configure the system not to cache responses to POST requests. (Since the text seems to appear after you click "Apply", i.e. probably a POST form action.)

Please reopen if you believe that this is not the issue.

This was my first thought, but it is not the case because I can replicate it on my machine directly accessing the Zope instance.

this is as far as I got with the trace back

in the portlet code in PortletSubscriptionAddForm.update() ...

> collective/dancing/browser/portlets/channelsubscribe.py(156)update()
-> super(PortletSubscriptionAddForm, self).update()
(Pdb) list
151 def newslettertool(self):
152 return getToolByName(self.context, 'portal_newsletters')
153
154 def update(self):
155 import pdb;pdb.set_trace()
156 -> super(PortletSubscriptionAddForm, self).update()
157 self.channel_id = self.context.id
158
159 if self.context.collector is not None:
160 stored_values = self.stored_values
161 collector_schema = self.context.collector.schema

self.widgets gets assigned somewhere in the super(...) call, but there is so much indirection here, I'm not able to effectively trace down the part which assigns the default value to welf.widgets["composer.email"].value

-> super(PortletSubscriptionAddForm, self).update()
(Pdb) n
> /home/adam/var/buildout-cache/eggs/collective.dancing-0.9.9-py2.6.egg/collective/dancing/browser/portlets/channelsubscribe.py(157)update()
-> self.channel_id = self.context.id

(Pdb) self.widgets["composer.email"].value
<email address hidden>'

Problem was subscribers email being set as default value on the collectors schema when accessing my-subscriptions.html with a valid secret. Proper brain fart.

Fix and regression test committed in #248820

Great. I was also biten by this bug. Do you know when a new version ist beeing released?