[Privacy] Gitea leaks hidden email addresses

[ghost]

• Gitea version (or commit ref): 3e445cc
• Git version: not relevant
• Operating system: not relevant
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

Screenshots

[msg7086]

Just hit this bug due to the CSRF issue. Got a long list of Email addresses for every victim of that issue.

(Automatically followed OP, then got notifications of all events, leaking the Email addresses.)

[techknowlogick]

For anyone looking to solve this issue, the line you can change is here:

gitea/models/issue_mail.go

Line 102 in 95f2e2b

SendIssueMentionMail(issue, doer, content, comment, getUserEmailsByNames(e, tos))

it passes all emails into the function, but what could be done is to loop over emails and then individually pass them into the SendIssueMentionMail function (the last argument in that function is where the emails get passed in)

[HenrikBengtsson]

Not a complaint, just asking for clarification: This fix means that email notifications for issues will be sent out to each watcher independently starting with Gitea 1.5.1, correct? This means that users will no longer be able to do 'Reply All' to continue an email-only thread on the topic, correct?

[lafriks]

@HenrikBengtsson yes