Admin avatars send every client's email address in plain text to avatar.clientexec.rocks

[Sheernox]

Env: ClientExec 7.2.2 (ionCube), PHP 8.5.10, MariaDB 11.8.9

Where: the avatar_url / avatar values the admin area renders, for example templates/admin/views/support/ticket/ticket.phtml line 125 ($assignee['avatar_url']) and the dashboard ticket list (templates/admin/views/home/index/dashboard.phtml line 327).

Bug: Every avatar is an image from https://avatar.clientexec.rocks/avatar/<email address>, with the person's email address in plain text in the URL path. Whenever staff open the dashboard, a ticket or a client, the browser requests one image per client or staff member shown, so the avatar service receives the email address of every customer staff look at (one dashboard load on our install made 8 such requests). There is no setting to turn avatars off or serve them locally, and the request is made even when the person has no avatar. Sending customer email addresses to a third party needs disclosure and a reason under privacy laws such as PIPEDA and GDPR.

Repro:

1. Sign in to the admin area and open the browser's network panel.
2. Open the dashboard, then any ticket.
3. Filter by clientexec.rocks: each avatar is a request to avatar.clientexec.rocks/avatar/ followed by a client's or staff member's email address.

Fix: Serve avatars locally (initials, or an uploaded image), or at least send a hash of the address instead of the address, and add a setting to turn remote avatars off.