Maybe I missed something, but I think I found a small security
related glitch in the wiki.debian.org registration process.

It seems currently possible to
	(a) confirm the existance of a wiki.debian.org account
	(b) reveal its linked email address

REMARK:
	(a) This might be always possible as you can simply try visiting:
https://wiki.debian.org/SomePerson
	    ? - Did not try to see what happens if one deletes his own Homepage.
	(b) This should really be a small security glitch as there is the "General option" on the users "Preferences" page:
		"Publish my email (not my wiki homepage) in author info"

Here is what I did:
	* Click on "Login"
	* Click on "Forgot your password"
	* Enter username, email
	* You get: "If this account exists an email was sent."

So far so good, but:

	* Click on "Login"
	* Click on "you can create one now"
	* Enter a username you want to know if it exists
	* Enter any email adress and any password
	* Click "Create Profile"
	* You get: "This user name already belongs to somebody else. If this is a new account and you need another verification link, try sending another one."

So this tells you that the account exists.

	* Click on "try sending another one" (works even if "User account has already been verified!")
	* You get: "Verification message re-sent to knuth@posern.org

And this tells you it's linked email address.

Tormen.

Hi, thanks for the report!

Right. The first is a hard one to fix, the second one I will work on
shortly. More details below:

The SomePerson pages isn't actually created automatically with the
account - it's up to people to set those up (or not) as they see fit.

Right.

Right. It's trying to be more friendly when creating a new account,
and a fairly standard approach on most websites where accounts are set
up by users directly. I'm not overly bothered to change this, I'll be
honest. Usernames need to be unique.

Correct. I'll fix that message to remove the email address. It's often
useful for debug, but it does leak too much. I'll also add a check on
current verification state too.

Dear Customer,

We could not deliver your item.
You can review complete details of your order in the find attached.

Kind regards,
Corey Moyer,
Support Manager.

Dear Customer,

Your parcel has arrived at October 16. Courier was unable to deliver the parcel to you.
You can review complete details of your order in the find attached.

Warm regards,
Darren Blackwell,
FedEx Station Agent.

Dear Customer,

This is to confirm that one or more of your parcels has been shipped.
Please, open email attachment to print shipment label.

Yours trully,
Alberto Hodge,
Delivery Agent.

Dear Customer,

We could not deliver your parcel.
Shipment Label is attached to email.

Thanks and best regards,
Dwayne Byrd,
FedEx Station Manager.

Dear Customer,



We could not deliver your parcel.

Please, open email attachment to print shipment label.



Yours faithfully,

Alfred Mcallister,

Sr. Support Manager.

Dear Customer,

Courier was unable to deliver the parcel to you.
Shipment Label is attached to email.

Sincerely,
Franklin Coffey,
FedEx Station Manager.