When inviting an already registered user by e-mail, the module exposes his username (stating "!email is already registered as !username" or similar).
I see a privacy risk in this chatty behavior, because it is possible for a Bully to find out the username of his victim just by providing his e-mail. The reason for having usernames is, to decouple the real identity (often losely bound to an e-mail address) from the virtual identity.
Would be nice to remove that message, or to add an option to enable it (which would be turned of by default).
Comments
Comment #1
glekli commentedGood point. Thanks for spotting this. The username has been removed from the message.
Committed to 7.x-2.x.