506547 - Password-reset notifications

Status: VERIFIED FIXED

(support.mozilla.org :: General, defect)

Description

[Chris Ilias [:cilias]]

We're getting reports that SUMO is sending email messages to accounts, saying "Someone coming from IP Address 10.2.81.4 requested password reset for your account  (support.mozilla.com). "

In bug 409942 comment 2, Dave Miller says that address is the IP address the internal address on the Netscaler. If we can't get bug 409942 fixed soon, we should at least stop these password reset notification emails.

Comment 1

[Dave Miller [:justdave]]

Better would probably be to just remove the IP address from the notification template.  The average person probably has no clue what their IP address is these days anyway.  It's really only useful to the sysadmin to help tracking if there's abuse (and could probably be included as a header in the message instead of in the body of the email, and we'll just need to get people to send full headers if they have suspected abuse).

Comment 2

[James Socol [:jsocol, :james]]

Laura: Just changing the template is quick, I can take this if you want to get rid of it.

Comment 3

[James Socol [:jsocol, :james]]

Attachment: patch, v1

This moves the IP address line into a mail header ('X-Password-Reset-From') as per comment #1.

Comment 4

[Laura Thomson :laura]

Comment on attachment 395948 [details] [diff] [review]
patch, v1

Good call, wfm.

Comment 5

[James Socol [:jsocol, :james]]

From bug 409942 comment 8, we can use X_FORWARDED_FOR.

Comment 6

[James Socol [:jsocol, :james]]

Attachment: patch, v2

This incorporates the code from AMO linked in comment 5. Otherwise it's the same (with some white space inserted to make tiki-remind_password.php a bit more readable).

Comment 7

[James Socol [:jsocol, :james]]

r50337 / r50338

Comment 8

[Vishal Kamdar [:vish_moz]]

Verified, FIXED.

Comment 9

[Marc Laporte]

Great idea. I never liked that message.

Comment 10

[Louis-Philippe Huberdeau]

Upstreamed to tiki trunk r22651.

Comment 11

[David Tenser [:djst]]

Added the string tiki_upstreamed to this bug to keep track of the things that are already upstreamed. LPH: please do this for other bugs you upstream; thanks!