diff options
| author | Robert Speicher <robert@gitlab.com> | 2015-12-10 04:58:11 +0300 |
|---|---|---|
| committer | Robert Speicher <robert@gitlab.com> | 2015-12-10 04:58:11 +0300 |
| commit | ba79d1e5b8e169b680f128539ade3b6786f4ebd0 (patch) | |
| tree | fe24b9fb492572633267bb0eae745a35baabc0ab /CHANGELOG | |
| parent | 19837682e0e2d8394dedb6432e004cb853d73cb1 (diff) | |
| parent | f4ec906e90b2f8dbf18b359b773e3b31f5da89ff (diff) | |
Merge branch 'devise_paranoid_mode' into 'master'
Enable Devise paranoid mode and ensure the returned message is the same
every time. This will prevent user enumeration (low impact).
Prior to this change a user could type an email in the password reset
field and if the email didn't exist it returned an error. If the email
was valid it returned a message saying the forgot password link had been
emailed. After this change the user will receive a message that if the
email is in our database the reset link will be emailed.
I also changed the throttle mechanism so it still works the same but
now returns the exact same message as above. Previously it would say
'You've already sent a request. Wait a few minutes'. This also allows
user enumeration, although it requires a double-check.
Related to https://dev.gitlab.org/gitlab/gitlabhq/issues/2624
See merge request !2044
Diffstat (limited to 'CHANGELOG')
| -rw-r--r-- | CHANGELOG | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/CHANGELOG b/CHANGELOG index 36a38bc3445..144b3487714 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -33,6 +33,9 @@ v 8.2.3 - Fix Error 500s when creating global milestones with Unicode characters (Stan Hu) - Update documentation for "Guest" permissions - Properly convert Emoji-only comments into Award Emojis + - Enable devise paranoid mode to prevent user enumeration attack + +v 8.2.3 - Webhook payload has an added, modified and removed properties for each commit - Fix 500 error when creating a merge request that removes a submodule |