if block caching is on, some users are able to see other users email addresses. While I personally didn't see this happen, during traffic spikes we did get enough emails to turn the module off until we did something about it.

My recommendation is to not have the from field.

thoughts?

CommentFileSizeAuthor
#5 spread-nocache.diff247 bytesjchatard

Comments

jchatard’s picture

jchatard commented

Hi,

Really sorry for the long waiting response. If we remove the From field, we no longer let anonymous users spread?

Is that really what we want?
Jérémy

jchatard’s picture

jchatard commented
Status: Active » Closed (won't fix)

I need more info on this!

amanuel’s picture

amanuel commented

I also experienced this during traffic spikes as drupal tries to cache the blocks.

We should perhaps not have the from email showing when the user is logged in instead just displaying their username/display name.

This may have ramifications to the cached block still...but at least it will not expose emails. We would have to investigate the block caching process to see how we can make sure that right block is cached for the right user.

amanuel’s picture

amanuel commented

lol I reported this issue....it really has been that long.

jchatard’s picture

jchatard commented
Status: Closed (won't fix) » Active
StatusFileSize
new spread-nocache.diff247 bytes

Hi amanuel,

Do you have more info on this?

Can you try the small patch attached which set Spread block to not cache?

Hope this helps.
Jérémy

amanuel’s picture

amanuel commented

Jérémy,

That's a great idea to fix the issue. I've implemented it and seems to be ok now

privatemsg has had some block issue as well and used the same solution to fix it. see http://drupal.org/node/370937

I'd commit this patch and close this issue.

I will come back here to let you know if the problem recurrs....I suspect it won't.

Thanks again.

jchatard’s picture

jchatard commented
Status: Active » Fixed

Commited patch thanks for the report.

Jérémy

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.