serv/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-12-28 22:53:54 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Prevented user enumeration of valid users through HTTP status codes of login (#3639) (#3654)

Browse source
This commit is contained in:
LefsFlare 2016-10-17 10:08:40 +08:00 committed by 无闻
parent 2bec8a4f1e
commit 2cb5ec5983
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
routers/user/auth.go
View file

@ -341,8 +341,10 @@ func ForgotPasswdPost(ctx *context.Context) {
u, err := models.GetUserByEmail(email) u, err := models.GetUserByEmail(email)
if err != nil { if err != nil {
if models.IsErrUserNotExist(err) { if models.IsErrUserNotExist(err) {
ctx.Data["Err_Email"] = true ctx.Data["Hours"] = setting.Service.ActiveCodeLives / 60
ctx.RenderWithErr(ctx.Tr("auth.email_not_associate"), FORGOT_PASSWORD, nil) ctx.Data["IsResetSent"] = true
ctx.HTML(200, FORGOT_PASSWORD)
return
} else { } else {
ctx.Handle(500, "user.ResetPasswd(check existence)", err) ctx.Handle(500, "user.ResetPasswd(check existence)", err)
} }