When inviting an already registered user by e-mail, the module exposes his username (stating "!email is already registered as !username" or similar).

I see a privacy risk in this chatty behavior, because it is possible for a Bully to find out the username of his victim just by providing his e-mail. The reason for having usernames is, to decouple the real identity (often losely bound to an e-mail address) from the virtual identity.

Would be nice to remove that message, or to add an option to enable it (which would be turned of by default).

Comments

glekli’s picture

Status: Active » Fixed

Good point. Thanks for spotting this. The username has been removed from the message.
Committed to 7.x-2.x.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.