fix: Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f)#10243
Conversation
The Pages and PublicAPI routes for resend_verification_email redirected to different pages on success vs failure, allowing user enumeration. Now respects the emailVerifySuccessOnInvalidEmail option (default true) to always redirect to the success page, matching the API route behavior.
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
967aa57
into
parse-community:release-8.x.x
## [8.6.51](8.6.50...8.6.51) (2026-03-19) ### Bug Fixes * Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f) ([#10243](#10243)) ([967aa57](967aa57))
## [8.6.51](8.6.50...8.6.51) (2026-03-19) ### Bug Fixes * Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f) ([#10243](#10243)) ([967aa57](967aa57))
## [8.6.51](8.6.50...8.6.51) (2026-03-19) ### Bug Fixes * Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f) ([#10243](#10243)) ([967aa57](967aa57))
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-8.x.x #10243 +/- ##
=================================================
+ Coverage 92.07% 92.49% +0.41%
=================================================
Files 192 192
Lines 15938 15944 +6
Branches 197 197
=================================================
+ Hits 14675 14747 +72
+ Misses 1242 1180 -62
+ Partials 21 17 -4 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Issue
Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f)