Nice! Converting this into a Flarum extension would allow for easy quality of life improvements:
- Reuse database connection
- Reuse mailer configuration
- Dynamically retrieve website name and icon
- Ability to use Blade templates
- Ability to use permissions for page access
Otherwise, as it currently stands, I have some remarks and suggestions:
I notice the website logo hash is also part of the template and will need to be edited by the user, not just the hostname. This value needs to be updated anytime the logo gets replaced through the admin panel.
I'm not sure about the character encoding used by the ATOM extension, but there's a risk the substr call cuts Unicode characters in half and break the output format. Using the mb_ methods for the length check and cut would probably be safer. I've had this exact problem with other Flarum scripts, it all works well until it doesn't and things fail in very mysterious ways when Unicode gets involved.
log_viewer.php doesn't seem to be protected(?) It seems to leak the list of emails to anyone who knows the endpoint exists.
It seems like anyone can call unsubscribe.php to unsubscribe any user by their email address without their consent. The script can also be repeatedly called to trigger an avalanche of emails towards a target, including with email addresses that are not registered in Flarum.
