4 ms·
Not sure if it was intentional, but unauthenticated users can see the email addresses of all non-anonymous commenters on a page. Specifically, a POST is made to
by _salmon 8y ago
Not sure if it was intentional, but unauthenticated users can see the email addresses of all non-anonymous commenters on a page. Specifically, a POST is made to "https://commento.io/api/comment/list" https://commento.io/api/comment/list"
Might want to hide those since this is supposed to be privacy-focused.
- adtac 8y agoFixed! Thanks, I'll patch this upstream soon enough :) I actually had the provision to omit the email in these requests [1], but I forgot to unset the email before responding. [1] https://gitlab.com/commento/commento/blob/master/api/commenter.go#L9 https://gitlab.com/commento/commento/blob/master/api/comment...