• Jan Provaznik's avatar
    Redact unsubscribe links in issuable texts · c1c14964
    Jan Provaznik authored
    It's possible that user pastes accidentally also unsubscribe link
    which is included in footer of notification emails. This unsubscribe
    link contains personal token which attacker then use to act as the
    original user (e.g. for sending comments under his/her identity).
    c1c14964
note.rb 13.2 KB