Password reset request - generally tighten it up#4636
Conversation
2e5bc9b to
5c5e0d0
Compare
|
Awesome work @davidread ! |
anotheredward
left a comment
There was a problem hiding this comment.
Overall it's looking pretty good, I've given it a test and added some feedback.
Thanks again for working on this @davidread :) .
| an email with a link to enter a new password.{% endtrans %}</p> | ||
| <p>{% trans %}Enter your email address or username into the box and we | ||
| will send you an email with a link to enter a new password. | ||
| {% endtrans %}</p> |
There was a problem hiding this comment.
Allowing users to enter their username is sensible for the case you've specified below (multiple users with the same email), but with the user listing being enabled by default, it essentially means an attacker has similar information available to them (complete listing of all the users, rather than complete listing of emails).
To patch this hole we'll need to get the users listing page disabled by default.
There was a problem hiding this comment.
Agreed. Let's not couple this PR to that piece of work though.
* Can only specify name or email not - not the looser search done by model.User.search() which allowed: partial name, partial fullname (and if sysadmin: partial emails) etc (This was originally loose to be helpful, but the balance with security changed) * Don't confirm whether a user exists or not * Logging for audit purposes
8b71bd7 to
c4707dc
Compare
|
I've merged @anotheredward 's additions and all is good. Over to you, @amercader for review! |
|
Looks good to me. Great work @davidread and @anotheredward! |
Fixes #
(This was originally loose to be helpful to users if they forgot their username, but it is more normal these days to only allow resets with your email address. I left in the username option, as explained in the code)
Features:
Please [X] all the boxes above that apply