mirror of
https://github.com/getgrav/grav.git
synced 2026-03-02 02:21:29 +01:00
0c38968c58
Security fix for IDOR-style information disclosure where the admin
email address was leaked in the <title> tag even on 403 Forbidden
responses.
The edit view title template previously included the email:
{{ fullname ?? username }} <{{ email }}>
Now shows only the name/username without email:
{{ fullname ?? username }}
This prevents low-privilege users from enumerating admin email
addresses by accessing /admin/accounts/users/{username} URLs.