From ea385f5d39a286ec36f3735fc7c5211b141f6165 Mon Sep 17 00:00:00 2001 From: JakobDev Date: Mon, 31 Jul 2023 03:18:38 +0200 Subject: Fix API leaking Usermail if not logged in (#25097) The API should only return the real Mail of a User, if the caller is logged in. The check do to this don't work. This PR fixes this. This not really a security issue, but can lead to Spam. --------- Co-authored-by: silverwind --- models/user/user.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'models/user') diff --git a/models/user/user.go b/models/user/user.go index 4b19eda67b..86cf2ad280 100644 --- a/models/user/user.go +++ b/models/user/user.go @@ -203,11 +203,16 @@ func UpdateUserTheme(u *User, themeName string) error { return UpdateUserCols(db.DefaultContext, u, "theme") } +// GetPlaceholderEmail returns an noreply email +func (u *User) GetPlaceholderEmail() string { + return fmt.Sprintf("%s@%s", u.LowerName, setting.Service.NoReplyAddress) +} + // GetEmail returns an noreply email, if the user has set to keep his // email address private, otherwise the primary email address. func (u *User) GetEmail() string { if u.KeepEmailPrivate { - return fmt.Sprintf("%s@%s", u.LowerName, setting.Service.NoReplyAddress) + return u.GetPlaceholderEmail() } return u.Email } -- cgit v1.2.3