mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-02-07 20:03:33 -05:00
92c6cca6a1
We shouldn’t have a page where someone can look up any other user’s email address based on their user ID. We also don’t want a page where a malicious user could send someone an link which would get them invited to the service. Restricting the invite to be populated just from users in their own organisation doesn’t mitigate against this stuff completely, but they probably have a way of finding out the email address of someone in their organisation already.