Skip to content

Possible security issue and GDPR violation by showing user email to everyone

Summary

Possible security issue and GDPR violation by showing email to everyone without asking their consent in location details page

Steps to reproduce

  1. Click the marker
  2. Click the 'View details' button
  3. You can see the user email there

What is the current bug behavior?

User email is visible to everyone without user consent

What is the expected correct behavior?

User email is not visible to everyone without user consent

Time

6.45 pm, 6.2.2022

Possible fixes

You could possibly

  1. ask user consent for it or tell user that email will be visible,
  2. hid it or
  3. change email to username and use the creator name there instead of full email address.