Dartymoor
2016-07-24 16:00:07
"Users send email via board:
Instead of showing the users email address users are able to send emails via the board."
Was Disabled. This means that the "Send email to Username" link on their profile page contained an un-obfuscated mailto: link to their full email address. Obviously this is a terrible thing to expose on a public site and I was only aware when a user mentioned other users had contacted them directly (Not maliciously). I checked before blindly say "No, we don't publish email addresses anywhere" to find that we actually were.
Changed to Enabled, now a simple form takes the message and sends it to the user without exposing the address.