also strip title from notification of private messages - it leaks potentially sensitive message info. Note: there is still information leakage of sender but this is difficult to avoid completely. "You've got an email from (we're sorry, we can't tell you...)"

1 files changed, 1 insertions, 1 deletions

diff --git a/include/enotify.php b/include/enotify.php
index a2b7b67b0..a774385da 100644
--- a/include/enotify.php
+++ b/include/enotify.php
@@ -397,7 +397,7 @@ function notification($params) {
 					if(! $private)
 						break;
 				case NOTIFY_MAIL:
-					$datarray['textversion'] = $datarray['htmlversion'] = '';
+					$datarray['textversion'] = $datarray['htmlversion'] = $datarray['title'] = '';
 					break;
 				default:
 					break;