diff options
| author | Robert Speicher <robert@gitlab.com> | 2015-12-10 01:58:11 +0000 |
|---|---|---|
| committer | Robert Speicher <robert@gitlab.com> | 2015-12-10 01:58:11 +0000 |
| commit | ba79d1e5b8e169b680f128539ade3b6786f4ebd0 (patch) | |
| tree | fe24b9fb492572633267bb0eae745a35baabc0ab /lib/api/commit_statuses.rb | |
| parent | 19837682e0e2d8394dedb6432e004cb853d73cb1 (diff) | |
| parent | f4ec906e90b2f8dbf18b359b773e3b31f5da89ff (diff) | |
| download | gitlab-ce-ba79d1e5b8e169b680f128539ade3b6786f4ebd0.tar.gz | |
Merge branch 'devise_paranoid_mode' into 'master'
Enable Devise paranoid mode and ensure the returned message is the same
every time. This will prevent user enumeration (low impact).
Prior to this change a user could type an email in the password reset
field and if the email didn't exist it returned an error. If the email
was valid it returned a message saying the forgot password link had been
emailed. After this change the user will receive a message that if the
email is in our database the reset link will be emailed.
I also changed the throttle mechanism so it still works the same but
now returns the exact same message as above. Previously it would say
'You've already sent a request. Wait a few minutes'. This also allows
user enumeration, although it requires a double-check.
Related to https://dev.gitlab.org/gitlab/gitlabhq/issues/2624
See merge request !2044
Diffstat (limited to 'lib/api/commit_statuses.rb')
0 files changed, 0 insertions, 0 deletions