Security for /email show

[Twonox]

A player who hack an account with a register email can easily see the registered email to be able to change it using /email change
So, I don't have any solution to suggest... just to remove that command but idk if this command is used frequently.

[sgdc3]

we should move it to the admin permissions subgroup

[ljacqu]

/email show was requested because there's no way for a user to see his own email address otherwise. We could add a permission to it (in the authme.player.* branch) so it may be disabled.

[sgdc3]

Yeah, you're right

[Twonox]

Other thing:
The email commands (like /email add, /email change, etc..) are not hidden. If that's normal, I think you should add those commands to the list of hidden commands for security reasons.

[Maxetto]

I'm providing also another security issue that relates to this.
If you hack an Account who has email, you can unregister it and register it back in order to give it another email and make it impossible to recover.

[sgdc3]

@HexelDev i'm a bit busy with my network atm, could you fix this in the meantime?