Never send user email address in HTTP requests

It used to be possible to customize 'url-privacy-level' so that the
user's email address was sent along in HTTP requests.  Since
'url-privacy-level' is also a blocklist, rather than an allowlist,
this meant that a mere misconfiguration of Emacs risked exposing the
user's email address.  This is a serious privacy risk, and it is thus
better if we remove this dangerous feature altogether.

* lisp/url/url-http.el (url-http-create-request): Never send the
user email address.
* lisp/url/url-vars.el (url-personal-mail-address): Make obsolete.
* lisp/url/url-privacy.el (url-setup-privacy-info): Don't set
above obsolete variable.
* doc/misc/url.texi (Customization):
* lisp/url/url-vars.el (url-privacy-level): Update documentation
to reflect the above changes.

doc/misc/url.texi

@@ -1231,8 +1231,6 @@ the @file{*URL-DEBUG*} buffer.
 A number means log all messages and show them with @code{message}.
 It may also be a list of the types of messages to be logged.
 @end defopt
-@defopt url-personal-mail-address
-@end defopt
 @defopt url-privacy-level
 @end defopt
 @defopt url-lastloc-privacy-level

etc/NEWS

@@ -1093,6 +1093,14 @@ Highlighting Tests" node in the ERT manual.
 
 ** URL
 
++++
+*** URL now never sends user email addresses in HTTP requests.
+Emacs never sent email addresses by default, but it used to be
+possible to customize 'url-privacy-level' so that the users email
+address was sent along in HTTP requests.  This feature has now been
+removed, as it was considered more risky than useful.  The user option
+'url-personal-mail-address' is now also obsolete.
+
 +++
 *** 'url-gateway-broken-resolution' is now obsolete.
 This option was intended for use on SunOS 4.x and Ultrix systems,

lisp/url/url-http.el

@@ -358,10 +358,6 @@ Use `url-http-referer' as the Referer-header (subject to `url-privacy-level')."
                   (url-port url-http-target-url))
                (format "Host: %s\r\n"
                        (url-http--encode-string (puny-encode-domain host))))
-             ;; Who its from
-             (if url-personal-mail-address
-                 (concat
-                  "From: " url-personal-mail-address "\r\n"))
              ;; Encodings we understand
              (if (or url-mime-encoding-string
 		     ;; MS-Windows loads zlib dynamically, so recheck

lisp/url/url-privacy.el

@@ -59,16 +59,6 @@
 	    ('tty "TTY")
 	    (_ nil)))))
 
-  (setq url-personal-mail-address (or url-personal-mail-address
-				      user-mail-address
-				      (format "%s@%s"  (user-real-login-name)
-					      (system-name))))
-
-  (if (or (memq url-privacy-level '(paranoid high))
-	  (and (listp url-privacy-level)
-	       (memq 'email url-privacy-level)))
-      (setq url-personal-mail-address nil))
-
   (setq url-os-type
 	(cond
 	 ((or (eq url-privacy-level 'paranoid)

lisp/url/url-vars.el

@@ -90,6 +90,7 @@ This is what is sent to HTTP servers as the FROM field in an HTTP
 request."
   :type '(choice (const :tag "Unspecified" nil) string)
   :group 'url)
+(make-obsolete-variable 'url-personal-mail-address nil "30.1")
 
 (defcustom url-directory-index-file "index.html"
   "The filename to look for when indexing a directory.
@@ -113,18 +114,22 @@ paranoid -- don't send anything
 
 If a list, this should be a list of symbols of what NOT to send.
 Valid symbols are:
-email    -- the email address
+email    -- the email address (in Emacs 29 or older)
 os       -- the operating system info
 emacs    -- the version of Emacs
 lastloc  -- the last location (see also `url-lastloc-privacy-level')
 agent    -- do not send the User-Agent string
 cookies  -- never accept HTTP cookies
 
+Emacs 30 and newer never includes the email address in the
+User-Agent string.  If you expect to use older versions of Emacs,
+it is recommended to always customize this list to include `email'.
+
 Samples:
 
  (setq url-privacy-level \\='high)
  (setq url-privacy-level \\='(email lastloc))    ;; equivalent to \\='high
- (setq url-privacy-level \\='(os))
+ (setq url-privacy-level \\='(email lastloc os emacs))
 
 ::NOTE::
 This variable controls several other variables and is _NOT_ automatically