github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 06:41:25 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FEATURE: hide_email_address_taken forces use of email in forgot password form (#15362)

Browse Source 
* FEATURE: hide_email_address_taken forces use of email in forgot password form

This strengthens this site setting which is meant to be used to harden sites
that are experiencing abuse on forgot password routes.

Previously we would only deny letting people know if forgot password worked on not
New change also bans usage of username for forgot password when enabled
This commit is contained in:
Sam
2021-12-20 12:54:10 +11:00
committed by GitHub
parent 1cdb5b7e4a
commit b6c3e9aa03
7 changed files with 51 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
app/controllers/session_controller.rb
View File

@ -434,7 +434,11 @@ class SessionController < ApplicationController
RateLimiter.new(nil, "forgot-password-hr-#{request.remote_ip}", 6, 1.hour).performed!
RateLimiter.new(nil, "forgot-password-min-#{request.remote_ip}", 3, 1.minute).performed!
user = User.find_by_username_or_email(normalized_login_param)
if SiteSetting.hide_email_address_taken
user = User.find_by_email(Email.downcase(normalized_login_param))
else
user = User.find_by_username_or_email(normalized_login_param)
end
if user
RateLimiter.new(nil, "forgot-password-login-day-#{user.username}", 6, 1.day).performed!
@ -449,7 +453,8 @@ class SessionController < ApplicationController
end
json = success_json
unless SiteSetting.hide_email_address_taken
if !SiteSetting.hide_email_address_taken
json[:user_found] = user_presence
end