Prevent email enumeration (#1000)

Here is my attempt to prevent user enumeration. 
I've made the following changes:

**Application:**
- replaces success and failure messages in the form with two (with/without redis) information messages 
- adds logging for attempted password resets of unknown users
- adds logging for failing emails

**Tests:**
- test_unknown asserts a redirect instead of a ok
- adds test_email_reset_twice_redis to assert the correct logging of a twice reset email 
- adds a FakeRedis class similiar to the one implemented in test_metrics.py. I could refactor them into the testutils folder if prefered. 

Please excuse the commit mess. I am currently fighting with my tooling.
This commit is contained in:
Lukas Bockstaller
2018-08-31 10:28:39 +02:00
committed by Raphael Michel
parent 099b08f009
commit a643abe293
3 changed files with 88 additions and 27 deletions

View File

@@ -180,12 +180,4 @@ class PasswordForgotForm(forms.Form):
super().__init__(*args, **kwargs)
def clean_email(self):
email = self.cleaned_data['email']
try:
self.cleaned_data['user'] = User.objects.get(email=email)
return email
except User.DoesNotExist:
raise forms.ValidationError(
_("We are unable to find a user matching the data you provided."),
code='unknown_user'
)
return self.cleaned_data['email']