Linebreak in team membership request breaks URL

Bug #776811 reported by Kevin Cole
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Launchpad itself
Triaged
Critical
Unassigned

Bug Description

I recently received a request to join our team which came in as (copied from a "show original" view):
_________________________________________
...
Sender: <email address hidden>
Errors-To: <email address hidden>
Precedence: bulk
X-Generated-By: Launchpad (canonical.com); Revision="12956";
 Instance="launchpad-lazr.conf"
X-Launchpad-Hash: d8304cdc45d4270e56bd048b6dcbe67eba7b56f5

Hello Kevin Cole,

Julian Clark (julian.clark) wants to be a member of Washington, DC LoCo
(ubuntu-districtofcolumbia), but this is a moderated team, so that
membership has to be approved. You can approve, decline or leave it as
proposed by following the link below.

    https://launchpad.net/~ubuntu-
districtofcolumbia/+member/julian.clark
...
_________________________________________

It appears to have been sent with the newline after the dash, which means that the mail client interprets the URL as

    https://launchpad.net/~ubuntu-

instead of:

    https://launchpad.net/~ubuntu-districtofcolumbia/+member/julian.clark

Revision history for this message
Kevin Cole (kjcole) wrote :

(It may not be a security vulnerability, but since it took me to an unexpected URL that actually worked, I felt there might be some potential for malicious abuse, however minor.)

Aaron Bentley (abentley)
Changed in launchpad:
status: New → Triaged
importance: Undecided → Critical
Curtis Hovey (sinzui)
tags: added: email team
William Grant (wgrant)
security vulnerability: yes → no
visibility: private → public
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.