FriendsOfSymfony/FOSUserBundle — Issue #402: Resetting process exposes user email
Author: ddebree
Created: 2011-11-14 06:07:34+00:00
State: open

When the user goes through the reset password (resetting) process, the first page the user sees is the request form. In this form the user can either input their username or their email.
When they submit the page they are redirected to the page to check their email.
This could be a potential security risk since this gives the person requesting the password-reset the mapping between the username and the password.
For example, if the usernames are publically exposed, a spammer could use this functionality to find the users real email address.

Possibly this issue could be solved by returning what was originally requested. For example if the user requests the username, show a message with the username. If they request the email, return email.
Alternatively, the message which includes the email could use a shortened email. For example, instead of test@gmail.com, the message could be "Email reset sent to email ending in "@gmail.com".