[buddypress-trac] [BuddyPress] #4039: Blog comments link to a user's activity via the same email address, regardless of it being them or not

buddypress-trac at lists.automattic.com buddypress-trac at lists.automattic.com
Thu Feb 23 08:53:54 UTC 2012


#4039: Blog comments link to a user's activity via the same email address,
regardless of it being them or not
-------------------------+-----------------------------
 Reporter:  mdpane       |      Owner:
     Type:  enhancement  |     Status:  new
 Priority:  normal       |  Milestone:  Awaiting Review
Component:  Core         |    Version:  1.5.4
 Severity:  normal       |   Keywords:
-------------------------+-----------------------------
 Assuming blog comments are unmoderated:

 - A user ‘test’ has an account with the email ‘test at email.com’
 - Someone who isn’t logged in posts a blog comment with the email
 ‘test at email.com’
 - A new item is added to the activity stream saying the user ‘test’ added
 this comment, since 'test' has that same email address.

 So it's possible to spoof someone if you know their email address and get
 a blog comment posted to their activity stream, even if it may not
 actually be them.

-- 
Ticket URL: <https://buddypress.trac.wordpress.org/ticket/4039>
BuddyPress <http://buddypress.org/>
BuddyPress


More information about the buddypress-trac mailing list