Password reset request - generally tighten it up #4636
Conversation
davidread
force-pushed
the
security_dont_confirm_if_user_exists_2
branch
from
2e5bc9b to
5c5e0d0
Compare
|
Awesome work @davidread ! |
There was a problem hiding this comment.
Overall it's looking pretty good, I've given it a test and added some feedback.
Thanks again for working on this @davidread :) .
| an email with a link to enter a new password.{% endtrans %}</p> | ||
| <p>{% trans %}Enter your email address or username into the box and we | ||
| will send you an email with a link to enter a new password. | ||
| {% endtrans %}</p> |
There was a problem hiding this comment.
Allowing users to enter their username is sensible for the case you've specified below (multiple users with the same email), but with the user listing being enabled by default, it essentially means an attacker has similar information available to them (complete listing of all the users, rather than complete listing of emails).
To patch this hole we'll need to get the users listing page disabled by default.
There was a problem hiding this comment.
Agreed. Let's not couple this PR to that piece of work though.
* Can only specify name or email not - not the looser search done by model.User.search() which allowed: partial name, partial fullname (and if sysadmin: partial emails) etc (This was originally loose to be helpful, but the balance with security changed) * Don't confirm whether a user exists or not * Logging for audit purposes
davidread
force-pushed
the
security_dont_confirm_if_user_exists_2
branch
from
8b71bd7 to
c4707dc
Compare
|
I've merged @anotheredward 's additions and all is good. Over to you, @amercader for review! |
|
Looks good to me. Great work @davidread and @anotheredward! |
smotornyuk
added
zBackport 2.8.4
zBackport 2.7.7
and removed
Backport 2.8.4
zBackport 2.7.8
Backport pending
labels
Fixes #
(This was originally loose to be helpful to users if they forgot their username, but it is more normal these days to only allow resets with your email address. I left in the username option, as explained in the code)
Features:
Please [X] all the boxes above that apply