mirror of
https://github.com/pretix/pretix.git
synced 2026-05-03 14:54:04 +00:00
Prevent email enumeration (#1000)
Here is my attempt to prevent user enumeration. I've made the following changes: **Application:** - replaces success and failure messages in the form with two (with/without redis) information messages - adds logging for attempted password resets of unknown users - adds logging for failing emails **Tests:** - test_unknown asserts a redirect instead of a ok - adds test_email_reset_twice_redis to assert the correct logging of a twice reset email - adds a FakeRedis class similiar to the one implemented in test_metrics.py. I could refactor them into the testutils folder if prefered. Please excuse the commit mess. I am currently fighting with my tooling.
This commit is contained in:
committed by
Raphael Michel
parent
099b08f009
commit
a643abe293
@@ -180,12 +180,4 @@ class PasswordForgotForm(forms.Form):
|
||||
super().__init__(*args, **kwargs)
|
||||
|
||||
def clean_email(self):
|
||||
email = self.cleaned_data['email']
|
||||
try:
|
||||
self.cleaned_data['user'] = User.objects.get(email=email)
|
||||
return email
|
||||
except User.DoesNotExist:
|
||||
raise forms.ValidationError(
|
||||
_("We are unable to find a user matching the data you provided."),
|
||||
code='unknown_user'
|
||||
)
|
||||
return self.cleaned_data['email']
|
||||
|
||||
Reference in New Issue
Block a user