registered emails for all users available via anonymous api

Just to be clear this can also be used to harvest emails enmass across the entire launchpad population.

collected_emails = []
batch = lp.people[0:100]
for person in batch:
     collected_emails.extend(list(person.confirmed_email_address))

This is not a bug. The API must honour the same rules of the web site. Only logged users can see email address, and only those email address that are designated to be public.

The defect here is that anonymous users can see public email addresses that they cannot see in web pages.

canonical.launchpad.security.ViewEmailAddress.checkUnauthenticated does verify that private addresses are not shown, but I think the rules are bogus. The method should only return False because no anonymous user is permitted to see email addresses. The rules might odd because the web UI uses obfuscation. Fixing this may topple pages that work with IEmailAddress and anonymous users.

I think this script can verify that anon interactions are fixed:
from launchpadlib.launchpad import Launchpad

def anon_emails():
    lp = Launchpad.login_anonymously("testing", "https://api.qastaging.launchpad.net/")
    person = lp.people["jml"]
    print list(person.confirmed_email_addresses)

def user_emails():
    lp = Launchpad.login_with('testing', 'https://api.qastaging.launchpad.net/')
    person = lp.people["barry"]
    print list(person.confirmed_email_addresses)

if __name__ == '__main__':
    print "Checking authenticated"
    user_email()
    print "Checking anon"
    anon_emails()

Thanks for having a look at this, but the script above is a little confusing in output, in that barry doesn't have any public email addresses. here's a variation that raises an error if anon logins can see emails (currently raises an error), since jml has public addresses.

from launchpadlib.launchpad import Launchpad

def verify_anon_emails():
    lp = Launchpad.login_anonymously("testing", "https://api.qastaging.launchpad.net/")
    person = lp.people["jml"]
    anon_emails = list(person.confirmed_email_addresses)

    lp = Launchpad.login_with('testing', 'https://api.qastaging.launchpad.net/')
    person = lp.people["jml"]
    auth_emails = list(person.confirmed_email_addresses)

    assert anon_emails != auth_emails, "Anon able to see emails"

if __name__ == '__main__':
    print "Verifing anonymous emails"
    verify_anon_emails()

The script was written from the perspective of a registry admin, i want to see barry's addresses.

Fixed in stable r12048 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/12048>.