Comment 'Name' and 'Email can be manipulated even if CommentsRequireLogin is true

[LeviWB]

If the getCommentsRequireLogin() function for a record returns true, then the email and name fields on the comment form become hidden fields with the value being set to the name and email of the logged in member.

This makes sense as we would want the name and email of the commenter to come straight from the member object, but if a comment is submitted outside the form or the hidden value changed to something else then the comment can appear to be coming from a different member.

We have had this issue raised during a pentest. The issue is mitigated by the fact that the member object/ID is still logged against the comment itself so it could be audited but it would be nice to either have a config option to prevent the email/name being set if getCommentsRequireLogin() is true, or possibly have this become the default behavior.