security: fixed returning info on weither user exists or not in password reset call, fixes #7619

2017-04-11 16:50:16 +02:00
parent a109049de4
commit 07466b6725
2 changed files with 13 additions and 5 deletions
@@ -12,7 +12,8 @@ func SendResetPasswordEmail(c *middleware.Context, form dtos.SendResetPasswordEm
 	userQuery := m.GetUserByLoginQuery{LoginOrEmail: form.UserOrEmail}

 	if err := bus.Dispatch(&userQuery); err != nil {
-		return ApiError(404, "User does not exist", err)
+		c.Logger.Info("Requested password reset for user that was not found", "user", userQuery.LoginOrEmail)
+		return ApiError(200, "Email sent", err)
 	}

 	emailCmd := m.SendResetPasswordEmailCommand{User: userQuery.Result}