#31505: Document possible email address enumeration in PasswordResetView.
-------------------------------------+-------------------------------------
Reporter: Mohammad Almazroa | Owner: felixxm
Type: | Status: closed
Cleanup/optimization |
Component: Documentation | Version: 3.0
Severity: Normal | Resolution: fixed
Keywords: User Enumeration | Triage Stage: Accepted
Security Bug |
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Florian Apolloner):
Replying to [comment:12 Mohammad Almazroa]:
> Question: why not fix PasswordResetView? documenting it is just not
enough.
Well, suggestions on fixes are welcome… Unless we want to change the reset
view to enter the username (in which case we'd leak usernames instead), I
do not see any obvious way on how to fix this.
--
Ticket URL: <https://code.djangoproject.com/ticket/31505#comment:13>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.57f5571ef1cb2ae2c51df1328669196d%40djangoproject.com.
