673175 - information leak - email address of last user to comment awaiting moderation was being shown

Status: RESOLVED DUPLICATE of bug 652560

(Developer Engagement :: Mozilla Hacks, task, P1)

Description

[Stephanie Daugherty [:sdaugherty]]

Attachment: another user's email address being shown

I commented earlier on this story, and it was being held for moderation. I refreshed the page later to see if my comment had been posted, and was able to see the email address of the last user to leave a comment on the page (see attached screenshot)

Comment 1

[Wil Clouser [:clouserw]]

Fastest fix for this is to send no-cache headers for any pages that have that box on them.

Comment 2

[Jesse Ruderman]

Would "Vary: Cookie" do the trick?

Comment 3

[Wil Clouser [:clouserw]]

I doubt it unless the blog is starting sessions for everyone.

Comment 4

[John Karahalis [:openjck]]

I cannot reproduce. I can see my own contact information in the form when I visit the page a second time, but not the contact information of another user.

The strange thing here is that Stephanie is even /seeing/ a comment that is in moderation. Normal users cannot do this. Maybe she was logged in? But after testing with jswisher, it appears that even logged-in users cannot see the contact information of other commenters today.

Marking as WORKSFORME. Please reopen if I am mistaken.

Comment 5

[John Karahalis [:openjck]]

Tagging this correctly, just in case it is reopened.

Comment 7

[Will Kahn-Greene [:willkg] ET needinfo? me]

For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.