1
0
Fork 0

Update password reset copy so as not to reveal whether the email exists

A malicious user could use this to test which email addresses are in the
user database.
This commit is contained in:
Mouse Reeve 2022-07-06 19:34:00 -07:00
parent 96bf99034c
commit fd5e513ad6
3 changed files with 10 additions and 5 deletions

View file

@ -9,7 +9,13 @@
<div class="block">
<h1 class="title">{% trans "Reset Password" %}</h1>
{% if message %}<p class="notification is-primary">{{ message }}</p>{% endif %}
{% if sent_message %}
<p class="notification is-primary">
{% blocktrans trimmed %}
A password reset link will be sent to <strong>{{ email }}</strong> if there is an account using that email address.
{% endblocktrans %}
</p>
{% endif %}
<p>{% trans "A link to reset your password will be sent to your email address" %}</p>
<form name="password-reset" method="post" action="/password-reset">