email addresses in bug descriptions should be obfuscated

Bug #140575 reported by Martin Pool
2
Affects Status Importance Assigned to Milestone
Launchpad itself
High
Unassigned

Bug Description

Per bug 60195, we hide email addresses in bug comments from anonymous users. However, we currently don't hide addresses that are present in bug descriptions. (The first comment, from the user's point of view.) Since our general policy is not to show addresses to unauthenticated users this should be fixed.

Joey Stanford (joey)
Changed in launchpad-answers:
assignee: nobody → sinzui-is
importance: Undecided → High
status: New → Confirmed
Revision history for this message
Tim Penhey (thumper) wrote :

Actually bug 60195 isn't fully fixed, as is illustrated with comment 8:

https://bugs.edge.launchpad.net/malone/+bug/60195/comments/8

Revision history for this message
Curtis Hovey (sinzui) wrote : Re: [Bug 140575] Re: email addresses in bug descriptions should be obfuscated

On Tue, 2007-09-18 at 04:28 +0000, Tim Penhey wrote:
> Actually bug 60195 isn't fully fixed, as is illustrated with comment 8:
>
> https://bugs.edge.launchpad.net/malone/+bug/60195/comments/8
>

Comment 8 looks right to me. When I'm logged in I can see my email
address, and then I'm not I see <email address hidden>.

Martin's quoting habits were a big incentive to me to get this
fixed. ;)

--

__C U R T I S C. H O V E Y_______
Guilty of stealing everything I am.

Revision history for this message
Martin Pool (mbp) wrote : Re: [Bug 140575] Re: email addresses in bug descriptions should be obfuscated

On 9/18/07, Tim Penhey <email address hidden> wrote:
> Actually bug 60195 isn't fully fixed, as is illustrated with comment 8:
>
> https://bugs.edge.launchpad.net/malone/+bug/60195/comments/8

At the moment it shows "<email address hidden>" (with anglebrackets,
without doublequotes). Personally I would have shown the username
component and hidden the domain, so that you can get some idea who it
is without encouraging spam. This is just my 2c though.

--
Martin

Revision history for this message
Curtis Hovey (sinzui) wrote : Re: [Bug 140575] Re: email addresses in bug descriptions should be obfuscated

On Tue, 2007-09-18 at 05:30 +0000, Martin Pool wrote:
> On 9/18/07, Tim Penhey <email address hidden> wrote:
> > Actually bug 60195 isn't fully fixed, as is illustrated with comment 8:
> >
> > https://bugs.edge.launchpad.net/malone/+bug/60195/comments/8
>
> At the moment it shows "<email address hidden>" (with anglebrackets,
> without doublequotes). Personally I would have shown the username
> component and hidden the domain, so that you can get some idea who it
> is without encouraging spam. This is just my 2c though.

Me too. I changed it to <email address hidden> in review after several
comments.

--

__C U R T I S C. H O V E Y_______
Guilty of stealing everything I am.

Revision history for this message
Curtis Hovey (sinzui) wrote :

The same problem must exist in launchpad answers. Unknowing users may type or paste program output with realizing the email address will be visible in the question's description. Since bugs will be convertible to questions, the need for hiding the email address will apply.

Changed in launchpad-answers:
assignee: nobody → sinzui-is
importance: Undecided → High
status: New → Confirmed
Revision history for this message
Curtis Hovey (sinzui) wrote :

After discussing this issue with Steve and Francis, the correct solution is to move the email obfuscation feature below the presentation level to hide personal email addresses in the entire page. We are considering a solution that will make pages by anonymous users obfuscatable to provide a comprehensive solution to this problem.

Changed in malone:
milestone: 1.1.10 → 1.1.11
Revision history for this message
Curtis Hovey (sinzui) wrote :

Moving this back a release given that we want a comprehensive solution.

Changed in launchpad-answers:
milestone: 1.1.10 → 1.1.11
Curtis Hovey (sinzui)
Changed in malone:
status: Confirmed → In Progress
Changed in launchpad-answers:
status: Confirmed → In Progress
Revision history for this message
Curtis Hovey (sinzui) wrote :

I think this issue is blocked. Email information maybe tainted by the with '<wbr></wbr>' sequences after the content is rendered. I cannot reliably identify an email address. I can move back to my original plan of adding fmt:obfucate-email to all the locations we use description that may have an email address. If I don't get any direction on this in the next few days, this issue will slip another release.

Revision history for this message
Björn Tillenius (bjornt) wrote :

On Fri, Oct 26, 2007 at 04:00:52AM -0000, Curtis Hovey wrote:
> I think this issue is blocked. Email information maybe tainted by the
> with '<wbr></wbr>' sequences after the content is rendered. I cannot
> reliably identify an email address. I can move back to my original plan
> of adding fmt:obfucate-email to all the locations we use description
> that may have an email address. If I don't get any direction on this in
> the next few days, this issue will slip another release.

Adding fmt:obfuscate-email to the descriptions of questions and bugs
should be fairly quick fix, wouldn't it? I'd say, do that, and then file
another bug for doing this more general.

Revision history for this message
Curtis Hovey (sinzui) wrote :

Well that was my original plan. About What do I say in my review? "I rejected my pre-implementation call to fix this as I thought was best." I'll send my notes regarding what I thought had to change and how I would do it.

Revision history for this message
Curtis Hovey (sinzui) wrote :

Fixed in RF 5170.

Changed in launchpad-answers:
status: In Progress → Fix Committed
Changed in malone:
status: In Progress → Fix Committed
Revision history for this message
Curtis Hovey (sinzui) wrote :

Fix released in Launchpad 1.1.11.

Changed in launchpad-answers:
status: Fix Committed → Fix Released
Changed in malone:
status: Fix Committed → Fix Released
Curtis Hovey (sinzui)
Changed in launchpad:
assignee: Curtis Hovey (sinzui) → nobody
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers