- Status changed to RTBC
over 1 year ago 2:47pm 19 June 2023 - @obriat opened merge request.
This module still leaves data that could be use to enumerate users. In this case its the value of DrupalSettings' currentPath.
# You just need php + composer
composer create-project drupal/recommended-project example.localhost -n
cd example.localhost
composer require drush/drush
vendor/bin/drush si standard --locale=fr --db-url=sqlite://../drupal.sqlite -y
composer require drupal/username_enumeration_prevention
vendor/bin/drush en username_enumeration_prevention -y
vendor/bin/drush --quiet runserver 8888 &
diff <(curl http://127.0.0.1:8888/user/1 -sv) <(curl http://127.0.0.1:8888/user/100 -sv)
...
< <script type="application/json" data-drupal-selector="drupal-settings-json">{"path":{"baseUrl":"\/","scriptPath":null,"pathPrefix":"","currentPath":"user\/1","currentPathIsAdmin":false,"isFront":false,"currentLanguage":"fr"},"pluralDelimiter":"\u0003","suppressDeprecationErrors":true,"ajaxTrustedUrl":{"\/search\/node":true},"user":{"uid":0,"permissionsHash":"c693ecfe15f364491727ae2f803543c57ae831034238047f08998408675ec052"}}</script>
---
> <script type="application/json" data-drupal-selector="drupal-settings-json">{"path":{"baseUrl":"\/","scriptPath":null,"pathPrefix":"","currentPath":"","currentPathIsAdmin":false,"isFront":false,"currentLanguage":"fr"},"pluralDelimiter":"\u0003","suppressDeprecationErrors":true,"ajaxTrustedUrl":{"\/search\/node":true},"user":{"uid":0,"permissionsHash":"c693ecfe15f364491727ae2f803543c57ae831034238047f08998408675ec052"}}</script>
Use hook_js_settings_alter to remove this info (or to set it to the requested path) on 404. Or return a fast 404 ?
none
none
none
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.