By jdsaward on

I found that module 'comment notify' utilizes the init field of the user table. I posted an issue about that - http://drupal.org/node/119566.

The init field seems to be used to retain the email address that is supplied at account creation, and is retained when changes are made. The changes are stored in the 'mail' field.

So, first query. Why?

Second query. Is this in anyway a security issue. The init field does not seem to be accessible via any form, but only directly from the database. It thus gets forgotten easily. It is particularly of concern for the number 1 account. Would it provide any potential for the original installer to access any account or reset a password?

Thanks.

John

⋅ Categories: Drupal 4.7.x

Comments

Chris Johnson’s picture

Chris Johnson commented

Using the init email address in the comment_notify module is a bug and indeed a security leak. It may send information which should remain private to valid, current site members to someone who is no longer a site member. In my environment with my customers, that is a definite security problem.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

I'm not so sure this is a security issue, but let's talk about how to "fix" it (ideally in the issue queue).

I guess the module should not send mail to blocked accounts and also should remove subscriptions for anyone with a "blocked" account. I've entered those as an issue here: http://drupal.org/node/289726

Beyond that...I'm all ears.

--
Open Prediction Markets | Drupal Dashboard | Learn more about Drupal - buy a Drupal Book

--
Morris Animal Foundation

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

And here's a patch for this... http://drupal.org/node/289726#comment-950153

--
Open Prediction Markets | Drupal Dashboard | Learn more about Drupal - buy a Drupal Book

--
Morris Animal Foundation