Redmine

The attached patch adds a new migration which sets the database default for new roles from users_visibility: all to users_visibility: members_of_visible_projects which is likely a safer general default. This change only affects newly created roles. As Rails takes the default column value of the database into account when creating a new role, this is enough to set the default value

The migration then also updates the builtin roles (Anonymous and Non-Member) to the new value, regardless of their existing value. Unfortunately, we can not distinguish if the migration is run during the initial setup (i.e. on an initially empty database) or later on an existing Redmine. As such, this may change deliberate role settings (to be more restrictive / secure). I think, this could be safe here as the current default of showing all users is likely unwanted for most installations.

If this is unwanted, we may also alternatively update the existing 20141109112308_add_roles_users_visibility.rb migration to set the builtin role's user visibility to members_of_visible_projects while keeping the previous database default unchanged in the old migration. We can then still change the database default in a new migration which is applied to both new and updated Redmine installations.

As for hiding the data of visible users: I'm not sure about this. Could you explain what hiding the login name would provide in additional security? This information is not really private and can be used in various locations anyways, e.g. the @-mention autocomplete.

Adding the user's pages to the robots.txt exclusion list may be warranted, but I don't have a strong opinion about that. This appears to be security-by-obscurity rather than an actual security improvement.

I've committed the migration. I don't think it's a big deal to manually change back to "all" for builtin roles.