Security Issue: Visibility of E-mail Addresses

[Valkyrian Legion]

As a security measure on my forum, I've long ensured that every new registrant's E-mail was set to 'hidden' to prevent harassment, stalking and espionage. However I recently discovered that even if someone's E-mail is hidden on their profile, it can still be viewed by regular users viewing the membership list!

This highlights the usefulness of administrators having a secondary, regular, account with which to log in and explore the forum from a non-administrator perspective.

To deal with the security breach, I made the entire memberlist unviewable to regular members.

[ccbtimewiz]

Regular members cannot view email address-- only an administrator can. This includes the memberlist as it calls the same query as other sections.

[Valkyrian Legion]

Regular members cannot view email address-- only an administrator can. This includes the memberlist as it calls the same query as other sections.

That's what I thought for a while, until I logged in with my non-administrator account and saw that a regular member account can view the E-mails in the memberlist. Like I said, having a regular account is a must for administrators, just so they can ensure that the forum appears as it should for regular members.

[Alex]

Make sure the users have unticked the share email box.

[Valkyrian Legion]

Make sure the users have unticked the share email box.

I've been manually checking the box for "Hide email address from public?" on every new registrant's profile from day one. Only recently did I find that this did not conceal it on the memberlist. Is this the 'share email box' you refer to, or is there another one besides the box on the user profiles?

It seems to me, this is a shortcoming in the programming, so I'll be posting about it on simplemachines.org . However people here should be aware of the issue, so that if they do value the privacy of their members, they can render the memberlist unviewable until the matter is resolved.

[Alex]

We will look into this but SMFNew has not altered any of the email settings, it may be a bug with SMF.