NodeBB Email Exposure Bug - Gravatar Plugin
-
http://mangolassi.it/topic/9205/mangolassi-is-leaking-everyone-s-email-address/
Log out, and go to someone profile page. Then ctrl+f and type in "@" and you will find anyone email address.
Emails are displayed in the pages, even when people have chosen to hidden them. Our users found this after people have started to get spam with unique email addresses only used on NodeBB. HTTPS does not help.
-
From what we can tell, this was the Gravatar plugin using raw emails instead of the hash to call out to gravatar.
-
@scottalanmiller that not good
-
@scottalanmiller sent a PR to the gravatar plugin repository to fix the issue. not sure when it's going to be merged and published.
you can disable the "Force users to use gravatar" option in the plugins ACP page or manually apply the fix from the PR in the meantime to fix the issue on your setup.
-
@pichalite Thank you!
