From 11ab2c8b1b9238c7ca3470a6e254b5a0e9745e6e Mon Sep 17 00:00:00 2001 From: Karl Persson Date: Mon, 24 Oct 2022 20:40:33 +0200 Subject: [PATCH] Security: Omit error from http response when user does not exists (#596) --- pkg/api/password.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/api/password.go b/pkg/api/password.go index 487c1e1c33d..e87c5af9811 100644 --- a/pkg/api/password.go +++ b/pkg/api/password.go @@ -28,8 +28,8 @@ func (hs *HTTPServer) SendResetPasswordEmail(c *models.ReqContext) response.Resp userQuery := models.GetUserByLoginQuery{LoginOrEmail: form.UserOrEmail} if err := hs.SQLStore.GetUserByLogin(c.Req.Context(), &userQuery); err != nil { - c.Logger.Info("Requested password reset for user that was not found", "user", userQuery.LoginOrEmail) - return response.Error(200, "Email sent", err) + c.Logger.Info("Requested password reset for user that was not found", "user", userQuery.LoginOrEmail, "error", err) + return response.Error(200, "Email sent", nil) } emailCmd := models.SendResetPasswordEmailCommand{User: userQuery.Result}