Don't send emails in cookies

app/controllers/admin/emails_controller.rb

@@ -35,9 +35,23 @@ module Admin
         @filter_type = params[:filter_type]
         @search_term = params[:search_term]
       when 'compose'
-        @recipient_emails = params[:recipient_emails] || []
+        if params[:bulk_session_token]
-        @filter_type = params[:filter_type]
+          @bulk_session = BulkEmailSession.active.find_by(token: params[:bulk_session_token])
-        @search_term = params[:search_term]
+          if @bulk_session && !@bulk_session.expired?
+            @recipient_emails = @bulk_session.recipient_emails
+            @filter_type = @bulk_session.filter_type
+            @search_term = @bulk_session.search_term
+          else
+            redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'filter'),
+                        alert: 'Bulk email session expired. Please start again.'
+            return
+          end
+        else
+          # Fallback to old method for backward compatibility
+          @recipient_emails = params[:recipient_emails] || []
+          @filter_type = params[:filter_type]
+          @search_term = params[:search_term]
+        end
       end
     end
 
@@ -58,12 +72,53 @@ module Admin
       }
     end
 
+    def create_bulk_session
+      authorize! :index, @conference.email_settings
+
+      recipient_emails = params[:recipient_emails] || []
+      filter_type = params[:filter_type]
+      search_term = params[:search_term]
+
+      if recipient_emails.empty?
+        redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'recipients',
+                                                      filter_type: filter_type, search_term: search_term),
+                    alert: 'No recipients selected.'
+        return
+      end
+
+      # Clean up any expired sessions
+      BulkEmailSession.cleanup_expired!
+
+      # Create new session
+      @bulk_session = BulkEmailSession.create!(
+        recipient_emails: recipient_emails,
+        filter_type: filter_type,
+        search_term: search_term
+      )
+
+      redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'compose',
+                                                    bulk_session_token: @bulk_session.token)
+    end
+
     def send_bulk
       authorize! :index, @conference.email_settings
 
       subject = params[:subject]
       body = params[:body]
-      recipient_emails = params[:recipient_emails] || []
+
+      # Get recipient emails from either bulk session or direct params
+      if params[:bulk_session_token]
+        bulk_session = BulkEmailSession.active.find_by(token: params[:bulk_session_token])
+        if bulk_session && !bulk_session.expired?
+          recipient_emails = bulk_session.recipient_emails
+        else
+          redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'filter'),
+                      alert: 'Bulk email session expired. Please start again.'
+          return
+        end
+      else
+        recipient_emails = params[:recipient_emails] || []
+      end
 
       if subject.blank? || body.blank?
         redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'compose'),
@@ -84,6 +139,9 @@ module Admin
         Rails.logger.info "Bulk email queued - Subject: '#{subject}' - Recipient: #{user.email}"
       end
 
+      # Clean up the bulk session after use
+      bulk_session&.destroy
+
       redirect_to admin_conference_emails_path(@conference.short_title),
                   notice: "Bulk email sent to #{recipients.count} recipients."
     end

app/views/admin/emails/_bulk_compose.html.haml

@@ -3,8 +3,10 @@
     %h3 Step 3: Compose Email
 
     = form_tag send_bulk_admin_conference_emails_path(@conference.short_title), method: :post, class: 'form-horizontal' do
-      - @recipient_emails.each do |email|
+      = hidden_field_tag :bulk_session_token, params[:bulk_session_token] if params[:bulk_session_token]
-        = hidden_field_tag 'recipient_emails[]', email
+      - if !params[:bulk_session_token] && @recipient_emails
+        - @recipient_emails.each do |email|
+          = hidden_field_tag 'recipient_emails[]', email
 
       .form-group
         = label_tag :subject, 'Subject', class: 'col-sm-2 control-label'
@@ -26,7 +28,7 @@
       .form-group
         .col-sm-offset-2.col-sm-10
           = submit_tag 'Send Bulk Email', class: 'btn btn-success btn-lg', data: { confirm: "Are you sure you want to send this email to #{@recipient_emails.count} recipients?" }
-          = link_to 'Back to Recipients', bulk_admin_conference_emails_path(@conference.short_title, step: 'recipients', filter_type: params[:filter_type], search_term: params[:search_term]), class: 'btn btn-default'
+          = link_to 'Back to Recipients', bulk_admin_conference_emails_path(@conference.short_title, step: 'recipients', filter_type: @filter_type, search_term: @search_term), class: 'btn btn-default'
           = link_to 'Cancel', admin_conference_emails_path(@conference.short_title), class: 'btn btn-default'
 
   .col-md-4

app/views/admin/emails/_bulk_recipients.html.haml

@@ -6,8 +6,7 @@
       %strong= @selected_recipients.count
       recipients matching your filter criteria. Select the recipients you want to email:
 
-    = form_tag bulk_admin_conference_emails_path(@conference.short_title), method: :get, id: 'recipients-form' do
+    = form_tag create_bulk_session_admin_conference_emails_path(@conference.short_title), method: :post, id: 'recipients-form' do
-      = hidden_field_tag :step, 'compose'
       = hidden_field_tag :filter_type, @filter_type
       = hidden_field_tag :search_term, @search_term
 

config/routes.rb

@@ -119,6 +119,7 @@ Osem::Application.routes.draw do
         collection do
           get :bulk
           get :recipients
+          post :create_bulk_session
           post :send_bulk
         end
       end