Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: Do not inform if email exists in system when resetting password #1408

Merged

Conversation

i-oden
Copy link
Member

@i-oden i-oden commented Mar 15, 2023

Before submitting this PR

  1. Description: When a user tries to reset the password, the DDS currently displays a different message depending on if the email is registered to a user or not. This means that someone could potentially guess emails during an attempt to hack the system. The message should be identical, which this PR changes.
  2. Jira task / GitHub issue: DDS-1508
  3. How to test:
    1. Start up dds_web locally (docker)
    2. Go to 127.0.0.1:5000 -- the DDS web interface
    3. Click reset password
    4. Fill in email addresses -- the message should be the same, but the email may or may not be sent.
      1. An email address that's not registered
      2. An email address that is registered
      3. An email address that is registered but the user is deactivated - This will still currently display a different message, but it's rare enough (or possibly not used at all at the moment) that it's worth spending time on at the moment.
  4. Type of change: Check the relevant boxes in the section below
  5. Add docstrings and comments to code, even if you personally think it's obvious.

What type of change(s) does the PR contain?

  • New feature
    • Breaking: Please describe the reason for the break and how we can fix it.
    • Non-breaking
  • Database change
    • Migration included in PR
    • Migration not needed
  • Bug fix
    • Breaking: Please describe the reason for the break and how we can fix it.
    • Non-breaking
  • Security Alert fix
  • Documentation
  • Tests (only)
  • Workflow

Checklist

  • Sprintlog
    • Added
    • Not needed (E.g. PR contains only tests)
  • Rebase / Update / Merge from base branch (the branch from which the current is forked)
    • Done
    • Not needed
  • Blocking PRs
    • Merged
    • No blocking PRs
  • PR to master branch

Actions / Scans

  • Black: Python code formatter. Does not execute. Only tests.
    Run black . locally to execute formatting.
    • Passed
  • Prettier: General code formatter. Our use case: MD and yaml mainly.
    Run npx prettier --write . locally to execute formatting.
    • Passed
  • Yamllint: Linting of yaml files.
    • Passed
  • Tests: Pytest to verify that functionality works as expected.
    • New tests added
    • No new tests
    • Passed
  • CodeQL: Scan for security vulnerabilities, bugs, errors
    • New alerts: Go through them and either fix, dismiss och ignore. Add reasoning in items below.
    • Alerts fixed: What?
    • Alerts ignored / dismissed: Why?
    • Passed
  • Trivy: Security scanner
    • New alerts: Go through them and either fix, dismiss och ignore. Add reasoning in items below.
    • Alerts fixed: What?
    • Alerts ignored / dismissed: Why?
    • Passed
  • Snyk: Security scanner
    • New alerts: Go through them and either fix, dismiss och ignore. Add reasoning in items below.
    • Alerts fixed: What?
    • Alerts ignored / dismissed: Why?
    • Passed

@i-oden i-oden self-assigned this Mar 15, 2023
@i-oden i-oden marked this pull request as ready for review March 15, 2023 14:00
@i-oden i-oden requested a review from valyo March 15, 2023 14:00
Copy link
Member

@valyo valyo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works as intended

@i-oden i-oden merged commit 3af298b into dev Mar 17, 2023
@i-oden i-oden deleted the DDS-1508-reset-message-only-displayed-when-account-doesnt-exist branch March 17, 2023 13:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants