Follow-up to #8074, which collapsed every login failure onto one message so the login box stops revealing which emails have accounts. ForgotPassword undoes that from the next screen over.
AccountService.ForgotPassword (eFormAPI/eFormAPI.Web/Services/AccountService.cs:287-290) returns
User with <the email you typed> not found
for an unknown address, and success for a known one. It is [AllowAnonymous] (AccountController.cs:186-196), echoes the submitted address back, and has no lockout — so it is a cheaper oracle than the login box ever was: one request per address, no wrong-password attempts needed.
Fix
Return the same response whether or not the address exists — the standard "if that address has an account, we've sent a reset link" — and send the mail only when it does.
Related, same file
ResetPassword (:322-338) has no IsActive check, so a disabled account can complete a password reset. Harmless on its own now that login refuses disabled accounts, but confusing: the reset appears to succeed and the subsequent login does not.
Follow-up to #8074, which collapsed every login failure onto one message so the login box stops revealing which emails have accounts.
ForgotPasswordundoes that from the next screen over.AccountService.ForgotPassword(eFormAPI/eFormAPI.Web/Services/AccountService.cs:287-290) returnsfor an unknown address, and success for a known one. It is
[AllowAnonymous](AccountController.cs:186-196), echoes the submitted address back, and has no lockout — so it is a cheaper oracle than the login box ever was: one request per address, no wrong-password attempts needed.Fix
Return the same response whether or not the address exists — the standard "if that address has an account, we've sent a reset link" — and send the mail only when it does.
Related, same file
ResetPassword(:322-338) has noIsActivecheck, so a disabled account can complete a password reset. Harmless on its own now that login refuses disabled accounts, but confusing: the reset appears to succeed and the subsequent login does not.