Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Secure /reset from "leaking" email address info #4918

Closed
julianlam opened this issue Aug 8, 2016 · 1 comment
Closed

Secure /reset from "leaking" email address info #4918

julianlam opened this issue Aug 8, 2016 · 1 comment
Assignees
@julianlam
Labels
enhancement
Milestone
1.1.2

Comments

@julianlam
Copy link
Member

If an email is found in the database, you get "password reset sent". If not, you get an error alert saying the email doesn't exist.

A malicious user may use this as an interface to determine which emails are registered.

Suggestions:

  1. The server response should always be the same, an .alert-info saying "If this email address is found in our records, we will send a password reset request"
  2. If you hit the /reset route over a certain threshold, you should be blocked from using the form.
@pichalite
Copy link
Contributor

👍

@julianlam julianlam self-assigned this Aug 9, 2016
@julianlam julianlam added this to the 1.1.2 milestone Aug 9, 2016
BenLubar added a commit to boomzillawtf/tdwtf that referenced this issue Aug 11, 2016
@BenLubar
- **Per-category permissions now include edit/delete post, delete top…
af4bc7d 
…ic** <NodeBB/NodeBB#4909> <apxltd/what-bugs#50>

- Composer drag-and-drop target area contains entire composer, not just textarea <NodeBB/nodebb-plugin-composer-default#55>
- Fixed an admin panel client side graph problem <NodeBB/NodeBB#4921>
- Properly handle npm v3 dependencies <NodeBB/NodeBB@19b4679>
- Stopped the password reset page from revealing whether an email address existed in the database <NodeBB/NodeBB#4918>
- "Fork topic" style changes <NodeBB/nodebb-theme-persona#306>
- Fixed `unsaved-changes` popup <akhoury/nodebb-plugin-spam-be-gone#49>
- **Added forum-wide setting: "Number of replies after users are disallowed to delete their own topics."** <NodeBB/NodeBB#4919>
- Fixed username being missing from the account info page's breadcrumb <NodeBB/NodeBB#4930>
- Allow first page of group members to be retrieved via websocket <NodeBB/NodeBB#4934>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@julianlam julianlam

Labels
enhancement
Projects
None yet
Milestone
1.1.2
Development

No branches or pull requests
2 participants
@julianlam @pichalite