FS#45258 - [AUR 4.0] Cgit commit view should not publish Author's/Commiter's email address

Attached to Project: AUR web interface
Opened by Miroslav Koškár (mkoskar) - Monday, 08 June 2015, 11:25 GMT
Last edited by Lukas Fleischer (lfleischer) - Monday, 08 June 2015, 12:50 GMT
Task Type Bug Report
Category Security
Status Closed
Assigned To No-one
Architecture All
Severity Medium
Priority Normal
Reported Version 3.5.0
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Since there is already a way how *registered* users can contact maintainer,
e.g., by comments or by viewing his/her profile for contact information
including email, it should not be the case that cgit publishes email addresses
publicly for all to see.

It's a common practice to disable this (that's also the case for official
ArchLinux repositories, and community ones too), although of course emails can
be gathered by actually cloning repository. Concern here is I guess mainly
about web email crawlers and similar.

I believe the easiest way to do this is to set:

noplainemail=1

in `cgitrc`` file.

Thanks
This task depends upon

Closed by  Lukas Fleischer (lfleischer)
Monday, 08 June 2015, 12:50 GMT
Reason for closing:  Fixed
Additional comments about closing:  Fixed in 4.0.0-rc2.
Comment by Lukas Fleischer (lfleischer) - Monday, 08 June 2015, 11:34 GMT
Should be fixed, please confirm.
Comment by Johannes Löthberg (demize) - Monday, 08 June 2015, 11:41 GMT
(Also, it's not that the official repos strip them, it's that the git repo is converted from SVN, which doesn't keep the same info, so the rest is made up.)
Comment by Miroslav Koškár (mkoskar) - Monday, 08 June 2015, 11:50 GMT
Verified.

> (Also, it's not that the official repos strip them, it's that the git repo is converted from SVN, which doesn't keep the same info, so the rest is made up.)
Aha, I thought there is some other cgit option to mangle them that way. It makes sense now :).

Thanks for such super quick implementation, it's greatly appreciated.

Loading...