Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-9071

User E-Mail can be leaked using the "Forgot Password" feature

    XMLWordPrintable

Details

    • spam
    • Easy
    • N/A
    • N/A

    Description

      Normally, user e-mail is shown scrambled (e.g. in the profile with default skin). However, when a password reset mail is sent using the "Forgot Password" feature, the following message is shown:

      An e-mail was sent to bla@blub.com. Please follow the instructions in that e-mail to complete the password reset procedure.

      This can be used e.g. to collect e-mail addresses for spamming.

      Attachments

        Issue Links

          is duplicated by

          New Feature - A new feature of the product, which has yet to be developed. XWIKI-2223 Add a new display option to xwiki properties : [plain, obfuscated, hidden]

          • Major - Major loss of function.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. XWIKI-379 eMail address obfuscator

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          relates to

          Improvement - An improvement or enhancement to an existing feature or task. XWIKI-9223 Make the email obfuscation configurable through an XWiki preference

          • Major - Major loss of function.
          • Closed

          Activity

            People

              mflorea Marius Dumitru Florea
              nickless Alex Busenius
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: