Merge pull request #1 from mufeedvh/develop

Fix username enumeration
418sec · Aug 3, 2020 · f925b8f · f925b8f
2 parents 6fc7aa1 + 4b0dfb2
commit f925b8f
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/system/modules/user/src/Controller/ResetPasswordController.php b/app/system/modules/user/src/Controller/ResetPasswordController.php
@@ -44,7 +44,7 @@ public function requestAction($email)
             }
 
             if (!$user = User::findByEmail($email)) {
-                throw new Exception(__('Unknown email address.'));
+                throw new Exception(__('If this email exists, you will receive an email with the reset instructions.'));
             }
 
             if ($user->isBlocked()) {
@@ -69,7 +69,7 @@ public function requestAction($email)
             $user->activation = $key;
             $user->save();
 
-            App::message()->success(__('Check your email for the confirmation link.'));
+            App::message()->success(__('If this email exists, you will receive an email with the reset instructions.'));
 
             return App::redirect('@user/login');