public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: Omit error from http response when user does not exists (#596)

Browse Source
This commit is contained in:
Karl Persson
2022-10-24 19:40:33 +01:00
committed by GitHub
parent 360994050c
commit 11ab2c8b1b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/password.go
+2 -2
View File
@@ -28,8 +28,8 @@ func (hs *HTTPServer) SendResetPasswordEmail(c *models.ReqContext) response.Resp
userQuery := models.GetUserByLoginQuery{LoginOrEmail: form.UserOrEmail}
if err := hs.SQLStore.GetUserByLogin(c.Req.Context(), &userQuery); err != nil {
c.Logger.Info("Requested password reset for user that was not found", "user", userQuery.LoginOrEmail)
return response.Error(200, "Email sent", err)
c.Logger.Info("Requested password reset for user that was not found", "user", userQuery.LoginOrEmail, "error", err)
return response.Error(200, "Email sent", nil)
}
emailCmd := models.SendResetPasswordEmailCommand{User: userQuery.Result}