• Gitea version (or commit ref): 1.4.3
• Git version: 2.17.1
• Operating system: Ubuntu 14.04
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant

Description

Using the user search API, any logged in user can obtain emails of other gitea users.

For example, log into try.gitea.io then try hitting https://try.gitea.io/api/v1/users/search?q=chris in your browser and you will see the email addresses of all users with "chris" in their name.

I would suggest that showing emails should be off by default except for when viewed by admin users.

Thanks!