summaryrefslogtreecommitdiff
path: root/etc/NEWS
diff options
context:
space:
mode:
authorStefan Kangas <stefankangas@gmail.com>2023-12-17 09:45:05 +0100
committerStefan Kangas <stefankangas@gmail.com>2023-12-17 10:00:22 +0100
commit346e5712304e66bb1b52387115b89d1966cf184b (patch)
tree90b6b6bd0d9053e66458382cc2913ac6d1a9a65e /etc/NEWS
parent68565c0e90f0da375123e1283caf13c2309f8c46 (diff)
downloademacs-346e5712304e66bb1b52387115b89d1966cf184b.tar.gz
Never send user email address in HTTP requests
It used to be possible to customize 'url-privacy-level' so that the user's email address was sent along in HTTP requests. Since 'url-privacy-level' is also a blocklist, rather than an allowlist, this meant that a mere misconfiguration of Emacs risked exposing the user's email address. This is a serious privacy risk, and it is thus better if we remove this dangerous feature altogether. * lisp/url/url-http.el (url-http-create-request): Never send the user email address. * lisp/url/url-vars.el (url-personal-mail-address): Make obsolete. * lisp/url/url-privacy.el (url-setup-privacy-info): Don't set above obsolete variable. * doc/misc/url.texi (Customization): * lisp/url/url-vars.el (url-privacy-level): Update documentation to reflect the above changes.
Diffstat (limited to 'etc/NEWS')
-rw-r--r--etc/NEWS8
1 files changed, 8 insertions, 0 deletions
diff --git a/etc/NEWS b/etc/NEWS
index 491ade0..918c12b 100644
--- a/etc/NEWS
+++ b/etc/NEWS
@@ -1094,6 +1094,14 @@ Highlighting Tests" node in the ERT manual.
** URL
+++
+*** URL now never sends user email addresses in HTTP requests.
+Emacs never sent email addresses by default, but it used to be
+possible to customize 'url-privacy-level' so that the users email
+address was sent along in HTTP requests. This feature has now been
+removed, as it was considered more risky than useful. The user option
+'url-personal-mail-address' is now also obsolete.
+
++++
*** 'url-gateway-broken-resolution' is now obsolete.
This option was intended for use on SunOS 4.x and Ultrix systems,
neither of which have been supported by Emacs since version 23.1.