Closed (duplicate)
Project:
Invite
Version:
7.x-2.1-beta2
Component:
User interface
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
30 Jan 2012 at 07:12 UTC
Updated:
30 Jan 2012 at 17:06 UTC
Hello,
This seems like a possible issue of security. If a user attempts to invite a user who's email address is already active, the system error message says "The following recipient is already a member:
UserName (user@example.com)"
Seems like this could be an issue if someone were to type in an address of someone else, thus exposing their email address to the inviter
Comments
Comment #1
glekli commentedI believe this is the same issue as #1392488: username of invitee exposed, in case the invitee is already a registered user. This has been addressed there, and will be in the next release. Thanks for reporting, nonetheless.