ushahidi/riverid — Issue #5: Requesting a Password change works on nonregistered emails
Author: brianherbert
Created: 2011-12-29 05:01:30+00:00
State: open

When hitting a URL like:

https://crowdmapid.com/api/requestpassword?email=notaregisteredemail@test.com&mailbody=This%20is%20the%20mail%20body.%20Reset%20your%20password%20by%20going%20to%20http://whatever.com/%token%/and%20something.

It returns success "true", even though notaregisteredemail@test.com is not a registered email address. Should we be returning false with an error message here or is this done by design?