Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

/account/password/confirmReset has no validation on token/username #515

Closed
fcaps opened this issue Dec 2, 2023 · 1 comment
Closed

/account/password/confirmReset has no validation on token/username #515

fcaps opened this issue Dec 2, 2023 · 1 comment
Labels
good first issue

Comments

@fcaps
Copy link
Collaborator

fcaps commented Dec 2, 2023

this is how the url is actually called: /account/password/confirmReset?username=minion&token=xxx, but you can call it without the parameters and the form will still show up.

at least i would have the input validated/escaped and some warning showing that the link is not correct. (and not showing the form)
@beckpaul beckpaul mentioned this issue Dec 3, 2023
Merged
@fcaps
Copy link
Collaborator Author

fcaps commented Dec 3, 2023

@beckpaul i'll look for an option to let you "assign" issues, have to ask the admin for some kind of contributor role.

@fcaps fcaps closed this as completed Dec 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
good first issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@fcaps