[SECURITY ISSUE] Email not hidden on forum subscription emails

  • Author
    Posts
  • #1603086

    I’ve found a security issue with these forums. When I’ve been subscribed to forum threads, when I receive an email about them any email addresses included in the post aren’t hidden and are shown.

    I’m just wondering if this is a security issue or if staff are aware of it.

    The blog I need help with is technoteamblog.wordpress.com.

    #1603198

    justjennifer
    Moderator

    when I receive an email about them any email addresses included in the post aren’t hidden and are shown

    Email addresses that are included in forum posts are redacted by the forum software. Do you have a specific forum thread that you can use as an example?

    Tagged for Staff input as well.

    #1603200

    auxclass
    Member
    #1603201

    Here’s a forum thread that can be used as an example: https://en.forums.wordpress.com/topic/wordpresscom-8?replies=3#post-1579997

    On the 4th post on that thread has emails in it and when I received an email notification for that reply, I could see the emails on the email sent. Their must be a way for this to be fixed.

    #1603205

    kraftbj
    Staff

    Thanks. I’ve confirmed it as well. I’m asking our devs to take a look now.

    #1603206

    1tess
    Moderator Emeritus

    I’ve notified staff about this issue.

    #1603207

    @kraftbj That’s great. I wanted to make sure that this was a known issue by WordPress.com staff.

    #1603208

    kraftbj
    Staff

    Thanks for reporting it. I’ve let the rest of the staff who work on the forums know as well so we don’t ask folks to submit e-mail addresses expecting the redaction until it is cleared up.

    #1603297

    kraftbj
    Staff

    Thanks again for bringing this to our attention. We’ve deployed a fix that will redact the e-mail in subscription e-mails too.

    Cheers!

    #1603299

    You’re very welcome. I’m glad that the problem has been solved. Thanks for your quick response.

The topic ‘[SECURITY ISSUE] Email not hidden on forum subscription emails’ is closed to new replies.