Privacy / Security: Mail notification list all other users mail even if they hide their mail on gitea instance

[Perflyst]

Description

If you watch a public repo and get the mail about activity all other watchers mail adresses are listed in the "To:" even if the other users hide their mail (e.g. replaced with user@noreply.domain.tld on the gitea instance).

How to reproduce

Create three accounts (hide mail adress)
Create repo with account1
Watch repo with account2 and account3
Create issue with account1 in repo

See inbox from account2 and account3, both see the mail adress of each other

[adelowo]

What version are you running ? I think this has been fixed in master by #4664 ..

[Perflyst]

1.5.0

…

On August 31, 2018 2:19:56 PM UTC, Lanre Adelowo ***@***.***> wrote: What version are you running ? I think this has been fixed in master by #4664 .. -- You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub: #4834 (comment)

[techknowlogick]

@Perflyst please report any security issues to security@gitea.io, as @adelowo has mentioned this has been resolved, and will be released in 1.5.1. If this is currently an issue for you please use the 1.5 binary from the downloads site as it is pretty much equivalent with what 1.5.1 will be