Not a bug User account details disclosure
- Thread starter Karelke
- Start date
For future reference if you believe there to be a privacy/security leak it may be better to contact us privately by submitting a ticket from your customer area.
However, on this occasion, I'm not exactly understanding what you're reporting.
To clarify the main thing; there seems to be some element here of going directly to a user's tooltip URL which is, for example:
https://xenforo.com/community/members/chris-d.11388/tooltip
That doesn't change any behaviour in itself. You can see the user's tooltip any time by hovering over the user's name or avatar and only the most basic user profile information is displayed there.
There seems to be another aspect to your report which seems to be related to the ability to follow a user.
These are the privacy settings for the user from the video:
Notably the actual software privacy settings are different from the video:
I'm assuming you have profile posts disabled and I'm assuming you have the news feed disabled so the only entries I'd expect to see here by default are:
If so and that's what the report is about I think you need to report the issue there as it is not default functionality in the software.
However, on this occasion, I'm not exactly understanding what you're reporting.
To clarify the main thing; there seems to be some element here of going directly to a user's tooltip URL which is, for example:
https://xenforo.com/community/members/chris-d.11388/tooltip
That doesn't change any behaviour in itself. You can see the user's tooltip any time by hovering over the user's name or avatar and only the most basic user profile information is displayed there.
There seems to be another aspect to your report which seems to be related to the ability to follow a user.
These are the privacy settings for the user from the video:
Notably the actual software privacy settings are different from the video:
I'm assuming you have profile posts disabled and I'm assuming you have the news feed disabled so the only entries I'd expect to see here by default are:
- View your details
- Start conversations
- View your identities
If so and that's what the report is about I think you need to report the issue there as it is not default functionality in the software.
Last edited:
Karelke
Well-known member
Apologies, I will keep that in mind.
Correct.
That would be the "follow me" option.
Our website is in Dutch. The reporter who performed the audit translated the website with his browser, and some Dutch words have been translated wronly.
Similar threads
- Question
- Question
