Commit 4f5f8de2 authored by Ahmed Awan's avatar Ahmed Awan
Browse files

[24.0] Return generic message for password reset email 

This prevents existence of a user account from being queryable through password reset. We now return `None` and display a generic message regardless of a prt being created or not.

Fixes https://github.com/galaxyproject/galaxy/issues/18475
parent 58c55d4a

lib/galaxy/managers/users.py

+1 −1
Original line number Diff line number Diff line
@@ -609,7 +609,7 @@ class UserManager(base.ModelManager, deletable.PurgableManagerMixin): 
                    log.debug(body)

                    return f"Failed to submit email. Please contact the administrator: {util.unicodify(e)}"

            else:

                return "Failed to produce password reset token. User not found."

                return None



    def get_reset_token(self, trans, email):

        reset_user = get_user_by_email(trans.sa_session, email, self.app.model.User)

lib/galaxy/webapps/galaxy/controllers/user.py

+1 −1
Original line number Diff line number Diff line
@@ -342,7 +342,7 @@ class User(BaseUIController, UsesFormDefinitionsMixin): 
        payload = payload or {}

        if message := self.user_manager.send_reset_email(trans, payload):

            return self.message_exception(trans, message)

        return {"message": "Reset link has been sent to your email."}

        return {"message": "If an account exists for this email address a confirmation email will be dispatched."}



    def __get_redirect_url(self, redirect):

        if not redirect or redirect == "None":