| Description | Since the ID for the users gets calculated by the import (so, if the import is in alphabetical order we have an incremented order also in the IDs), someone could try to guess the ID of users if he has access to the mailserver-logfiles. Since the Webserver-Admin is most of the time also the admin of the mailserver on localhost, he would now have the possibility to de-anonymize some surveys. |
|---|
| Additional Information | A possible solution: Randomize the sending of the mails
Instead of using the ID to sort the list to send out the invitations, use a function to randomize that list. Since every mail has to get created individually, you only have to check the range of the IDs and check for not having duplicates while sending out.
Thank you in advance ;) |
|---|
