reviewer email addresses seem to be exposed

  • Resolved dconsorte

    (@dconsorte)


    4 years, 2 months ago

    Email addresses of each of the commenters are exposed to the public. I’m using it with the YITH Woocommerce Advanced Reviews plugin so it’s possible that the error is on their end, but I didn’t notice anything in their code.

    When I view source, I can see every review email address as alt text.

    I blocked the email address field in the YITH plugin by commenting out line 1451 of class.yith-woocommerce-advanced-reviews.php as a temporary solution but that breaks your Leira plugin (the letters no longer display). From a quick look at your code, it seems like you grab letters from the email address, so it’s a required field.

    Is there a better way to fix this, or an update?

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author Ariel

    (@arielhr1987)

    Hi @dconsorte

    I made a deep check on the problem you describe.
    Dont comment line 1451 of class.yith-woocommerce-advanced-reviews.php, intead search line 40 in file yith-woocommerce-advanced-reviews/templates/ywar-review.php You will see a line like this
    echo get_avatar( $author["review_author_email"], apply_filters( 'woocommerce_review_gravatar_size', '60' ), '', $author["review_author_email"] );
    the last parameter is the alt to show in the image. Just change that line by this one (to show an empty alt):
    echo get_avatar( $author["review_author_email"], apply_filters( 'woocommerce_review_gravatar_size', '60' ), '', '' );

    But the best approach here is to ask yith developers to add a filter in the function so you dont modify the plugin source code, as it will be overwritten if you update the plugin. You can suggest plugin developer a change like this:
    echo get_avatar( $author["review_author_email"], apply_filters( 'woocommerce_review_gravatar_size', '60' ), '', apply_filters('yith_review_avatar_alt', $author["review_author_email"]) );

    In the other hand i noticed that if an anonymous user makes a review the avatar won’t have any letter in the image, this due to an incompatibility between leira letter avatar and yith woo advanced reviews.

    I will try to fix this compatibility issue in the next plugin release

    • This reply was modified 4 years, 2 months ago by Ariel.
    Thread Starter dconsorte

    (@dconsorte)

    Thanks very much for your prompt response!

    Plugin Author Ariel

    (@arielhr1987)

    Hi @dconsorte
    YITH Woocommerce Advanced Reviews plugin is now supported by Leira Letter Avatar.
    Keep in mind that Leira Letter Avatar does not expose any email address in alt avatar img tag (or any other place), thats a problem with YITH Woocommerce Advanced Reviews problem as commented in this thread.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘reviewer email addresses seem to be exposed’ is closed to new replies.