Private project namespace revealed in email notification when issue is moved
HackerOne report #452827 by ashish_r_padelkar on 2018-11-29:
Summary: Hello,
When issue is moved , the email is sent to the users if they are subscribed to the issues.
Th email notification which is received for the issue subscriber reveals the project path of the issue that is moved in ,which may be private project under private group.
Description:
The email which is received when issue is moved looks like below
When you hover over the issue title link, you will see the new project path where this issue is moved in. Look at the browser status bar! or just click on the link!
Steps To Reproduce:
- Subscribe to any issue from public project by clicking notification button on right side
- Now as a reporter/admin, move this issue in private project under private group
- Subscriber should receive an email like above with link of issue title
- Hover over the link of issue title and you should see full path of the issue which includes private project path! or else click on the link!
Regards, Ashish
Impact
Attachments
Warning: Attachments received through HackerOne, please exercise caution!
Edited by Dennis Appelt