Privacy/Security: Need ability to hide user emails in Notifications metabox

[jerclarke]

I didn't notice this until we were about to launch but for us it's fundamentally a dealbreaker. When a user sees the Notifications box on a post editor they can not only see all users names (unnavoidable) but also their email addresses. I can see why this is the default (many users will be more idenfiable by email than display name) but in many cases it's a security problem.

In our case we have hundreds of authors from all over the world, and many are reporting from locations where their journalism could result in criminal investigation, harassment and arrest. In this context we try to maintain as much privacy for them as possible, and keeping their emails secret is part of it. In core WP only users with "edit_users" capability are able to see the emails of other users, which IMHO is reasonable compromise (since we need to trust and vet those people anyway).

I think EditFlow should offer a way to disable the display of emails in the Notifications box, as well as reconsidering the default behavior (maybe it could be display_name+user_name?)

Ideally a setting in Notifications would solve the problem completely for us, as well as reminding others to consider whether they want to make user emails visible in that way.

Alternately a filter to control the output would also work for me. Currently the output of the emails is completely hardcoded in EF_Module::users_select_form() in class-module.php, leaving me no way at all to stop the emails from being sent to the browser (though I can of course hide them with CSS or jQuery, that isn't actually removing them).

Here's some quickly tested code that adds a filter to control email display in users_select_form():

            <?php if (apply_filters('ef_users_select_form_display_user_email', true)) :?>
            <span class="ef-user_useremail"><?php echo esc_html( $user->user_email ); ?></span>
            <?php endif;?>

And the filter just for reference:

add_filter('ef_users_select_form_display_user_email', '__return_false');

[cojennin]

A patch to filter the details (email, user name, display name, etc) of the User and User Groups makes sense to me.

Do you have some time to work on a patch for this? If not I can try taking a crack at it when I have some time.