search

gentoo / recruiting.gentoo.org

[ORIGIN] Recruiting web application for Gentoo linux
http://recruiting.gentoo.org
7 stars 10 forks source link

E-mail disclosure on the forgotten pasword form #18

Open klondi opened 11 years ago

klondi commented 11 years ago

It's possible to use this form reply on wether an e-mail is or not on the DB to check which e-mails of those on the list are in it. This can be fixed by sending the same reply always.

isaiah commented 11 years ago

If I understand you right, being able to check if an email address is registered on this site is not a problem, no?

hwoarang commented 11 years ago

To be honest I don't understand the problem...

klondi commented 11 years ago

It is a problem, a spammeer can just check which addresses on his list are registered and which not and use that to target spam and phising attacks.

It may also be considered an issue under European data protection laws.