diff options
| author | Stefan Kangas <stefankangas@gmail.com> | 2023-12-17 09:45:05 +0100 |
|---|---|---|
| committer | Stefan Kangas <stefankangas@gmail.com> | 2023-12-17 10:00:22 +0100 |
| commit | 346e5712304e66bb1b52387115b89d1966cf184b (patch) | |
| tree | 90b6b6bd0d9053e66458382cc2913ac6d1a9a65e /etc/NEWS | |
| parent | 68565c0e90f0da375123e1283caf13c2309f8c46 (diff) | |
| download | emacs-346e5712304e66bb1b52387115b89d1966cf184b.tar.gz | |
Never send user email address in HTTP requests
It used to be possible to customize 'url-privacy-level' so that the
user's email address was sent along in HTTP requests. Since
'url-privacy-level' is also a blocklist, rather than an allowlist,
this meant that a mere misconfiguration of Emacs risked exposing the
user's email address. This is a serious privacy risk, and it is thus
better if we remove this dangerous feature altogether.
* lisp/url/url-http.el (url-http-create-request): Never send the
user email address.
* lisp/url/url-vars.el (url-personal-mail-address): Make obsolete.
* lisp/url/url-privacy.el (url-setup-privacy-info): Don't set
above obsolete variable.
* doc/misc/url.texi (Customization):
* lisp/url/url-vars.el (url-privacy-level): Update documentation
to reflect the above changes.
Diffstat (limited to 'etc/NEWS')
| -rw-r--r-- | etc/NEWS | 8 |
1 files changed, 8 insertions, 0 deletions
@@ -1094,6 +1094,14 @@ Highlighting Tests" node in the ERT manual. ** URL +++ +*** URL now never sends user email addresses in HTTP requests. +Emacs never sent email addresses by default, but it used to be +possible to customize 'url-privacy-level' so that the users email +address was sent along in HTTP requests. This feature has now been +removed, as it was considered more risky than useful. The user option +'url-personal-mail-address' is now also obsolete. + ++++ *** 'url-gateway-broken-resolution' is now obsolete. This option was intended for use on SunOS 4.x and Ultrix systems, neither of which have been supported by Emacs since version 23.1. |
