[buddypress-trac] [BuddyPress] #4039: Blog comments link to a user's activity via the same email address, regardless of it being them or not

[buddypress-trac at lists.automattic.com]

#4039: Blog comments link to a user's activity via the same email address,
regardless of it being them or not
-------------------------+-----------------------------
 Reporter:  mdpane       |      Owner:
     Type:  enhancement  |     Status:  new
 Priority:  normal       |  Milestone:  Awaiting Review
Component:  Core         |    Version:  1.5.4
 Severity:  normal       |   Keywords:
-------------------------+-----------------------------
 Assuming blog comments are unmoderated:

 - A user ‘test’ has an account with the email ‘test at email.com’
 - Someone who isn’t logged in posts a blog comment with the email
 ‘test at email.com’
 - A new item is added to the activity stream saying the user ‘test’ added
 this comment, since 'test' has that same email address.

 So it's possible to spoof someone if you know their email address and get
 a blog comment posted to their activity stream, even if it may not
 actually be them.

-- 
Ticket URL: <https://buddypress.trac.wordpress.org/ticket/4039>
BuddyPress <http://buddypress.org/>
BuddyPress