[Privacy] Gitea leaks hidden email addresses #2040

New Issue

GiteaMirror · 2025-11-02T04:22:02-06:00

GiteaMirror commented

2025-11-02 04:22:02 -06:00

Originally created by @ghost on GitHub (Jul 10, 2018).

Gitea version (or commit ref): 3e445cc
Git version: not relevant
Operating system: not relevant
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

Screenshots

Originally created by @ghost on GitHub (Jul 10, 2018).  - Gitea version (or commit ref): 3e445cc - Git version: not relevant - Operating system: not relevant - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: ## Description ## Screenshots

GiteaMirror added the topic/security label 2025-11-02 04:22:02 -06:00

GiteaMirror closed this issue

2025-11-02 04:22:02 -06:00

GiteaMirror commented

2025-11-02 04:22:02 -06:00

@msg7086 commented on GitHub (Aug 8, 2018):

Just hit this bug due to the CSRF issue. Got a long list of Email addresses for every victim of that issue.

(Automatically followed OP, then got notifications of all events, leaking the Email addresses.)

@msg7086 commented on GitHub (Aug 8, 2018): Just hit this bug due to the CSRF issue. Got a long list of Email addresses for every victim of that issue. (Automatically followed OP, then got notifications of all events, leaking the Email addresses.) ![email-leaking](https://user-images.githubusercontent.com/206155/43812115-b50fe426-9a8d-11e8-9575-ddcc66fd5093.png)

GiteaMirror commented

2025-11-02 04:22:02 -06:00

@techknowlogick commented on GitHub (Aug 10, 2018):

For anyone looking to solve this issue, the line you can change is here: 95f2e2b57b/models/issue_mail.go (L102) it passes all emails into the function, but what could be done is to loop over emails and then individually pass them into the SendIssueMentionMail function (the last argument in that function is where the emails get passed in)

@techknowlogick commented on GitHub (Aug 10, 2018): For anyone looking to solve this issue, the line you can change is here: https://github.com/go-gitea/gitea/blob/95f2e2b57beedcdeb2b9623dc86e26f252fdd7bd/models/issue_mail.go#L102 it passes all emails into the function, but what could be done is to loop over emails and then individually pass them into the `SendIssueMentionMail` function (the last argument in that function is where the emails get passed in)

GiteaMirror commented

2025-11-02 04:22:03 -06:00

@HenrikBengtsson commented on GitHub (Aug 30, 2018):

Not a complaint, just asking for clarification: This fix means that email notifications for issues will be sent out to each watcher independently starting with Gitea 1.5.1, correct? This means that users will no longer be able to do 'Reply All' to continue an email-only thread on the topic, correct?

@HenrikBengtsson commented on GitHub (Aug 30, 2018): Not a complaint, just asking for clarification: This fix means that email notifications for issues will be sent out to each watcher independently starting with Gitea 1.5.1, correct? This means that users will no longer be able to do 'Reply All' to continue an email-only thread on the topic, correct?

GiteaMirror commented

2025-11-02 04:22:03 -06:00

@lafriks commented on GitHub (Aug 30, 2018):

@HenrikBengtsson yes

@lafriks commented on GitHub (Aug 30, 2018): @HenrikBengtsson yes

GiteaMirror referenced this issue

2025-11-02 04:33:57 -06:00

Upgrade gopkg.in/testfixtures.v2 #2368

GiteaMirror referenced this issue

2025-11-02 12:04:47 -06:00

[PR #2058] [MERGED] Skip sqlite integration in CI #16208

GiteaMirror referenced this issue