diff options
author | Robert Speicher <robert@gitlab.com> | 2015-12-10 04:58:11 +0300 |
---|---|---|
committer | Robert Speicher <rspeicher@gmail.com> | 2015-12-10 04:59:14 +0300 |
commit | 0c0854c86a0d681aa5360b56b94cbc8f87f8dbad (patch) | |
tree | 3307ca9b0d70ab2b3e296a93d71e8f8aa42feae1 /app | |
parent | 9888a9725b5275962992d179b5deb27f7d9cadb2 (diff) |
Merge branch 'devise_paranoid_mode' into 'master'
Enable Devise paranoid mode and ensure the returned message is the same
every time. This will prevent user enumeration (low impact).
Prior to this change a user could type an email in the password reset
field and if the email didn't exist it returned an error. If the email
was valid it returned a message saying the forgot password link had been
emailed. After this change the user will receive a message that if the
email is in our database the reset link will be emailed.
I also changed the throttle mechanism so it still works the same but
now returns the exact same message as above. Previously it would say
'You've already sent a request. Wait a few minutes'. This also allows
user enumeration, although it requires a double-check.
Related to https://dev.gitlab.org/gitlab/gitlabhq/issues/2624
See merge request !2044
Diffstat (limited to 'app')
-rw-r--r-- | app/controllers/passwords_controller.rb | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/app/controllers/passwords_controller.rb b/app/controllers/passwords_controller.rb index 2025158d065..f74daff3bd0 100644 --- a/app/controllers/passwords_controller.rb +++ b/app/controllers/passwords_controller.rb @@ -40,7 +40,9 @@ class PasswordsController < Devise::PasswordsController def throttle_reset return unless resource && resource.recently_sent_password_reset? - redirect_to new_password_path(resource_name), - alert: I18n.t('devise.passwords.recently_reset') + # Throttle reset attempts, but return a normal message to + # avoid user enumeration attack. + redirect_to new_user_session_path, + notice: I18n.t('devise.passwords.send_paranoid_instructions') end end |