Repository: lldap/lldap (language: rust)

Issue:
[BUG] email for password reset is case sensitive, without error message
The email address for password reset is case sensitive (which I think it shouldn't be) and it says email send, even though it did not.

**To Reproduce**
Steps to reproduce the behavior:
1. Have a user with email@example.com
3. Open the passwort reset dialog
4. Enter email@example.com
5. Get the message that a reset token was send, but it did not.

**Expected behavior**
I would expect the email addresses to be compared case insensitive.

**Logs**
```
2024-02-09T16:31:15.432726718+00:00  DEBUG    HTTP request [ 617µs | 4.12% / 100.00% ] method: "GET" | uri: "/auth/reset/step1/Email@example.com"
2024-02-09T16:31:15.432747698+00:00  DEBUG    ┝━ get_password_reset_step1 [ 591µs | 3.00% / 95.88% ]
2024-02-09T16:31:15.432759474+00:00  DEBUG    │  ┕━ list_users [ 573µs | 92.88% ] filters: Some(Or([UserId(UserId("Email@example.com")), Equality(Email, "Email@example.com")])) | _get_groups: false
2024-02-09T16:31:15.433444707+00:00  DEBUG    │     ┕━ 🐛 [debug]:  | return: []
2024-02-09T16:31:15.433454503+00:00  DEBUG    ┕━ 🐛 [debug]:  | status_code: 200

```
**Additional context**
I'm running the current stable version (0.5.0)


Discussion / hints:
I'm pretty sure that's been fixed in latest.

Also, regarding getting the message that the reset token was sent, that's
WAI: otherwise, anyone can check whether an account exists or not based on
whether an email was sent or not. I'm being cautious with this flow since
it's one of the few unauthenticated ones. I could rephrase the message to
"If a user was found, an email got sent" or something like that, WDYT?

On Fri, Feb 9, 2024 at 5:33 PM jakob42 ***@***.***> wrote:

> The email address for password reset is case sensitive (which I think it
> shouldn't be) and it says email send, even though it did not.
>
> *To Reproduce*
> Steps to reproduce the behavior:
>
>    1. Have a user with ***@***.***
>    2. Open the passwort reset dialog
>    3. Enter ***@***.***
>    4. Get the message that a reset token was send, but it did not.
>
> *Expected behavior*
> I would expect the email addresses to be compared case insensitive.
>
> *Logs*
>
> 2024-02-09T16:31:15.432726718+00:00  DEBUG    HTTP request [ 617µs | 4.12% / 100.00% ] method: "GET" | uri: ***@***.***"
> 2024-02-09T16:31:15.432747698+00:00  DEBUG    ┝━ get_password_reset_step1 [ 591µs | 3.00% / 95.88% ]
> 2024-02-09T16:31:15.432759474+00:00  DEBUG    │  ┕━ list_users [ 573µs | 92.88% ] filters: ***@***.***")), Equality(Email, ***@***.***")])) | _get_groups: false
> 2024-02-09T16:31:15.433444707+00:00  DEBUG    │     ┕━ 🐛 [debug]:  | return: []
> 2024-02-09T16:31:15.433454503+00:00  DEBUG    ┕━ 🐛 [debug]:  | status_code: 200
>
>
> *Additional context*
> I'm running the current stable version (0.5.0)
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/lldap/lldap/issues/841>, or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAGCPWO4VCFG6AEHPXEHU6LYSZFW5AVCNFSM6AAAAABDBXY4F2VHI2DSMVQWIX3LMV43ASLTON2WKOZSGEZDONBYGMYDGNA>
> .
> You are receiving this because you are subscribed to this thread.Message
> ID: ***@***.***>
>


-- 
Valentin Tolmer

I think the changed error message would be an improvement, even though it's not that important.

I concur that the message shouldn't reveal too much.

If you leave the bug open, I'll test again after the next release. Or someone else finds time to check. My setup (crazy sync between three servers via rsync) makes it hard for me to try the nightlies.

Fix patch:
diff --git a/app/src/components/reset_password_step1.rs b/app/src/components/reset_password_step1.rs
index 57519ca8..30b79455 100644
--- a/app/src/components/reset_password_step1.rs
+++ b/app/src/components/reset_password_step1.rs
@@ -104,7 +104,11 @@ impl Component for ResetPasswordStep1Form {
                 </div>
                 { if self.just_succeeded {
                     html! {
-                      {"A reset token has been sent to your email."}
+                      {"If a user with this username or email exists, a password reset email will \
+                          be sent to the associated email address. Please check your email and \
+                          follow the instructions. If you don't receive an email, please check \
+                          your spam folder. If you still don't receive an email, please contact \
+                          your administrator."}
                     }
                 } else {
                     html! {


Test patch: