public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: Omit error from http response when user does not exists (#639)

Browse Source
This commit is contained in:
Karl Persson
2022-11-08 11:38:42 +01:00
committed by GitHub
parent f8239a2157
commit e5de51e2ef
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/password.go
+2 -2
View File
@@ -28,8 +28,8 @@ func (hs *HTTPServer) SendResetPasswordEmail(c *models.ReqContext) response.Resp
usr, err := hs.userService.GetByLogin(c.Req.Context(), &userQuery)
if err != nil {
c.Logger.Info("Requested password reset for user that was not found", "user", userQuery.LoginOrEmail)
return response.Error(http.StatusOK, "Email sent", err)
c.Logger.Info("Requested password reset for user that was not found", "user", userQuery.LoginOrEmail, "error", err)
return response.Error(http.StatusOK, "Email sent", nil)
}
if usr.IsDisabled {