878035 - Do not disclose whether a user account exists or not when a user clicks "forgot password"

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, enhancement)

Description

[Frédéric Buclin]

If you ask to change your forgotten password and you type an email address which doesn't exist, then the message should be the same as the one you get if the user account exists. See bug 670887 for some of the rationale.

Comment 1

[Frédéric Buclin]

Bonus point: the email sent to change the password should also include the IP address of the user asking for a new password. This way, this would give us a chance to track a potential attacker if many users receive the "change password" email with the same IP address in it.

Comment 2

[Frédéric Buclin]

Attachment: patch, v1

Comment 3

[David Lawrence [:dkl]]

Comment on attachment 756536 [details] [diff] [review]
patch, v1

Review of attachment 756536 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good and worked as expected. Nit can be fixed on checkin. r=dkl

::: template/en/default/account/password/forgotten-password.txt.tmpl
@@ +12,4 @@
>  X-Bugzilla-Type: admin
>  
>  You have (or someone impersonating you has) requested to change your 
> +[%+ terms.Bugzilla %] password. The request comes from [% ip_addr %].

nit: s/comes/originated/

Comment 4

[Frédéric Buclin]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified token.cgi
modified Bugzilla/Token.pm
modified template/en/default/account/password/forgotten-password.txt.tmpl
modified template/en/default/global/messages.html.tmpl
Committed revision 8634.