mirror of
https://github.com/getgrav/grav.git
synced 2026-05-09 02:37:29 +02:00
Fix email disclosure in user edit page title (GHSA-4cwq-j7jv-qmwg)
Security fix for IDOR-style information disclosure where the admin
email address was leaked in the <title> tag even on 403 Forbidden
responses.
The edit view title template previously included the email:
{{ fullname ?? username }} <{{ email }}>
Now shows only the name/username without email:
{{ fullname ?? username }}
This prevents low-privilege users from enumerating admin email
addresses by accessing /admin/accounts/users/{username} URLs.
This commit is contained in:
@@ -72,7 +72,7 @@ config:
|
||||
# Edit view
|
||||
edit:
|
||||
title:
|
||||
template: "{{ form.value('fullname') ?? form.value('username') }} <{{ form.value('email') }}>"
|
||||
template: "{{ form.value('fullname') ?? form.value('username') }}"
|
||||
|
||||
# Configure view
|
||||
configure:
|
||||
|
||||
Reference in New Issue
Block a user