feat: Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email #7551

dblythy · 2021-09-06T11:46:46Z

New Pull Request Checklist

I am not disclosing a vulnerability.
I am creating this PR in reference to an issue.

Issue Description

Allows the option for returning an error "A user with the email com does not exist." when an invalid password reset is called, instead of the current return true.

Closes: #7434

Approach

Adds password policy option: resetPasswordSuccessOnInvalidEmail, which defaults to true. Does not change any existing functionality unless implicitly set.

TODOs before merging

Add test cases
Add entry to changelog

parse-github-assistant · 2021-09-06T11:46:47Z

Thanks for opening this pull request!

🎉 We are excited about your hands-on contribution!

codecov · 2021-09-06T11:53:24Z

Codecov Report

Base: 94.15% // Head: 94.32% // Increases project coverage by +0.16% 🎉

Coverage data is based on head (0aa7f3f) compared to base (a49e323).
Patch coverage: 90.00% of modified lines in pull request are covered.

❗ Current head 0aa7f3f differs from pull request most recent head 1d77a97. Consider uploading reports for the commit 1d77a97 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha    #7551      +/-   ##
==========================================
+ Coverage   94.15%   94.32%   +0.16%     
==========================================
  Files         182      182              
  Lines       14400    14405       +5     
==========================================
+ Hits        13559    13587      +28     
+ Misses        841      818      -23

Impacted Files	Coverage Δ
src/Options/Definitions.js	`100.00% <ø> (ø)`
src/Options/index.js	`100.00% <ø> (ø)`
src/Routers/UsersRouter.js	`97.10% <87.50%> (+0.87%)`	⬆️
src/Config.js	`90.47% <100.00%> (+0.06%)`	⬆️
src/RestWrite.js	`94.31% <0.00%> (-0.30%)`	⬇️
src/Controllers/DatabaseController.js	`93.93% <0.00%> (+0.14%)`	⬆️
src/Adapters/Storage/Mongo/MongoTransform.js	`88.45% <0.00%> (+0.15%)`	⬆️
src/Controllers/SchemaController.js	`97.41% <0.00%> (+0.18%)`	⬆️
src/Adapters/Storage/Mongo/MongoStorageAdapter.js	`92.14% <0.00%> (+2.33%)`	⬆️
src/batch.js	`92.98% <0.00%> (+3.50%)`	⬆️
... and 2 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

mtrezza · 2021-09-10T02:39:09Z

Is this ready for review?

dblythy · 2021-09-10T02:41:04Z

I think so, I'm pretty sure the postgres tests are unrelated but not 100% sure

mtrezza · 2021-09-10T02:45:44Z

If you don't see the "Re-run" button in the Actions, you can alway close and re-open the PR, that will retrigger the test runs. Then the failing tests should pass (and possibly others fail)

mtrezza · 2021-09-10T02:51:49Z

I think steps 4, 5 are missing

…-community#7839)

## [5.2.1-alpha.1](parse-community/parse-server@5.2.0...5.2.1-alpha.1) (2022-03-26) ### Bug Fixes * return correct response when revert is used in beforeSave ([parse-community#7839](parse-community#7839)) ([f63fb2b](parse-community@f63fb2b))

… Cloud Function validation (parse-community#7892)

## [5.2.1-alpha.2](parse-community/parse-server@5.2.1-alpha.1...5.2.1-alpha.2) (2022-03-26) ### Performance Improvements * reduce database operations when using the constant parameter in Cloud Function validation ([parse-community#7892](parse-community#7892)) ([48bd512](parse-community@48bd512))

# [5.3.0-alpha.1](parse-community/parse-server@5.2.1-alpha.2...5.3.0-alpha.1) (2022-03-27) ### Features * add MongoDB 5.1 compatibility ([parse-community#7682](parse-community#7682)) ([90155cf](parse-community@90155cf))

…ommunity#7893)

# [5.3.0-alpha.2](parse-community/parse-server@5.3.0-alpha.1...5.3.0-alpha.2) (2022-03-27) ### Bug Fixes * security upgrade parse push adapter from 4.1.0 to 4.1.2 ([parse-community#7893](parse-community#7893)) ([ef56e98](parse-community@ef56e98))

# [5.3.0-alpha.3](parse-community/parse-server@5.3.0-alpha.2...5.3.0-alpha.3) (2022-03-27) ### Features * add MongoDB 5.2 support ([parse-community#7894](parse-community#7894)) ([6b4b358](parse-community@6b4b358))

src/Options/Definitions.js

spec/ValidationAndPasswordsReset.spec.js

src/Routers/UsersRouter.js

…alpha

src/Options/index.js

Signed-off-by: Manuel <5673677+mtrezza@users.noreply.github.com>

mtrezza

Looks good!

src/Options/Definitions.js

src/Options/docs.js

Signed-off-by: Manuel <5673677+mtrezza@users.noreply.github.com>

mtrezza · 2023-02-24T19:23:49Z

I've had another look at the options. Should this go under PasswordPolicyOptions since we also have things like resetTokenValidityDuration in there?

So this could be named passwordPolicy.resetResponseSuccessOnInvalidEmail. On the other hand it may not be strictly understood as a "password policy".

Anyway, let's just merge and hopefully someday restructure all options in a more meaningful way.

# [6.0.0-alpha.34](6.0.0-alpha.33...6.0.0-alpha.34) (2023-02-24) ### Features * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([#7551](#7551)) ([e5d610e](e5d610e))

parseplatformorg · 2023-02-24T19:32:30Z

🎉 This change has been released in version 6.0.0-alpha.34

# [6.1.0-beta.1](6.0.0...6.1.0-beta.1) (2023-03-02) ### Bug Fixes * Security upgrade jsonwebtoken to 9.0.0 ([#8420](#8420)) ([f5bfe45](f5bfe45)) ### Features * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([#8436](#8436)) ([b3b76de](b3b76de)) * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([#7551](#7551)) ([e5d610e](e5d610e)) * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([#8388](#8388)) ([a49e323](a49e323))

parseplatformorg · 2023-03-02T10:55:07Z

🎉 This change has been released in version 6.1.0-beta.1

# [6.1.0-alpha.1](6.0.0...6.1.0-alpha.1) (2023-03-03) ### Bug Fixes * Security upgrade jsonwebtoken to 9.0.0 ([#8420](#8420)) ([f5bfe45](f5bfe45)) ### Features * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([#8436](#8436)) ([b3b76de](b3b76de)) * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([#7551](#7551)) ([e5d610e](e5d610e)) * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([#8388](#8388)) ([a49e323](a49e323)) * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([#8443](#8443)) ([40c1961](40c1961))

parseplatformorg · 2023-03-03T16:53:45Z

🎉 This change has been released in version 6.1.0-alpha.1

# [6.1.0](6.0.0...6.1.0) (2023-05-01) ### Bug Fixes * LiveQuery can return incorrectly formatted date ([#8456](#8456)) ([4ce135a](4ce135a)) * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([#8446](#8446)) ([22d2446](22d2446)) * Parameters missing in `afterFind` trigger of authentication adapters ([#8458](#8458)) ([ce34747](ce34747)) * Rate limiting across multiple servers via Redis not working ([#8469](#8469)) ([d9e347d](d9e347d)) * Security upgrade jsonwebtoken to 9.0.0 ([#8420](#8420)) ([f5bfe45](f5bfe45)) ### Features * Add `afterFind` trigger to authentication adapters ([#8444](#8444)) ([c793bb8](c793bb8)) * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([#8436](#8436)) ([b3b76de](b3b76de)) * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([#7551](#7551)) ([e5d610e](e5d610e)) * Add rate limiting across multiple servers via Redis ([#8394](#8394)) ([34833e4](34833e4)) * Allow multiple origins for header `Access-Control-Allow-Origin` ([#8517](#8517)) ([4f15539](4f15539)) * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([#8388](#8388)) ([a49e323](a49e323)) * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([#8443](#8443)) ([40c1961](40c1961))

parseplatformorg · 2023-05-01T21:52:37Z

🎉 This change has been released in version 6.1.0

commit 1506273 Author: semantic-release-bot <semantic-release-bot@martynus.net> Date: Sat May 20 23:24:03 2023 +0000 chore(release): 6.2.0 [skip ci] # [6.2.0](parse-community/parse-server@6.1.0...6.2.0) (2023-05-20) ### Features * Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` ([parse-community#8538](parse-community#8538)) ([a318e7b](parse-community@a318e7b)) commit a318e7b Author: Manuel <5673677+mtrezza@users.noreply.github.com> Date: Sun May 21 01:23:00 2023 +0200 feat: Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` (parse-community#8538) commit 832702d Author: semantic-release-bot <semantic-release-bot@martynus.net> Date: Mon May 1 21:50:23 2023 +0000 chore(release): 6.1.0 [skip ci] # [6.1.0](parse-community/parse-server@6.0.0...6.1.0) (2023-05-01) ### Bug Fixes * LiveQuery can return incorrectly formatted date ([parse-community#8456](parse-community#8456)) ([4ce135a](parse-community@4ce135a)) * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([parse-community#8446](parse-community#8446)) ([22d2446](parse-community@22d2446)) * Parameters missing in `afterFind` trigger of authentication adapters ([parse-community#8458](parse-community#8458)) ([ce34747](parse-community@ce34747)) * Rate limiting across multiple servers via Redis not working ([parse-community#8469](parse-community#8469)) ([d9e347d](parse-community@d9e347d)) * Security upgrade jsonwebtoken to 9.0.0 ([parse-community#8420](parse-community#8420)) ([f5bfe45](parse-community@f5bfe45)) ### Features * Add `afterFind` trigger to authentication adapters ([parse-community#8444](parse-community#8444)) ([c793bb8](parse-community@c793bb8)) * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([parse-community#8436](parse-community#8436)) ([b3b76de](parse-community@b3b76de)) * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([parse-community#7551](parse-community#7551)) ([e5d610e](parse-community@e5d610e)) * Add rate limiting across multiple servers via Redis ([parse-community#8394](parse-community#8394)) ([34833e4](parse-community@34833e4)) * Allow multiple origins for header `Access-Control-Allow-Origin` ([parse-community#8517](parse-community#8517)) ([4f15539](parse-community@4f15539)) * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([parse-community#8388](parse-community#8388)) ([a49e323](parse-community@a49e323)) * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([parse-community#8443](parse-community#8443)) ([40c1961](parse-community@40c1961)) commit 18b63d1 Merge: f7eee19 f59d46c Author: Manuel <5673677+mtrezza@users.noreply.github.com> Date: Mon May 1 23:49:22 2023 +0200 build: Release (parse-community#8526)

dblythy changed the title ~~Forgot password~~ Allow transparent forgot password flow Sep 6, 2021

mtrezza and others added 11 commits March 25, 2022 19:47

ci: fix node engine check (parse-community#7891)

9ef1968

fix: return correct response when revert is used in beforeSave (parse…

f63fb2b

…-community#7839)

perf: reduce database operations when using the constant parameter in…

48bd512

… Cloud Function validation (parse-community#7892)

feat: add MongoDB 5.1 compatibility (parse-community#7682)

90155cf

chore(release): 5.3.0-alpha.1 [skip ci]

499cead

# [5.3.0-alpha.1](parse-community/parse-server@5.2.1-alpha.2...5.3.0-alpha.1) (2022-03-27) ### Features * add MongoDB 5.1 compatibility ([parse-community#7682](parse-community#7682)) ([90155cf](parse-community@90155cf))

fix: security upgrade parse push adapter from 4.1.0 to 4.1.2 (parse-c…

ef56e98

…ommunity#7893)

feat: add MongoDB 5.2 support (parse-community#7894)

6b4b358

chore(release): 5.3.0-alpha.3 [skip ci]

75eca2d

# [5.3.0-alpha.3](parse-community/parse-server@5.3.0-alpha.2...5.3.0-alpha.3) (2022-03-27) ### Features * add MongoDB 5.2 support ([parse-community#7894](parse-community#7894)) ([6b4b358](parse-community@6b4b358))

mtrezza force-pushed the alpha branch from 59215e6 to e6d7d8f Compare May 1, 2022 02:29

dblythy added 2 commits May 3, 2022 13:38

Merge remote-tracking branch 'upstream/alpha' into alpha

61ef23f

Merge remote-tracking branch 'upstream/alpha' into alpha

606ed96

dblythy force-pushed the forgotPassword branch from 59bf44f to dccf278 Compare May 19, 2022 11:56

dblythy changed the title ~~Allow transparent forgot password flow~~ feat: allow transparent forgot password flow May 19, 2022

dblythy requested a review from a team May 22, 2022 04:45

mtrezza requested changes May 29, 2022

View reviewed changes

dblythy added 5 commits June 7, 2022 11:33

Merge branch 'alpha' of https://github.com/dblythy/parse-server into …

1e89817

…alpha

Merge remote-tracking branch 'upstream/alpha' into alpha

9720e8e

Merge remote-tracking branch 'upstream/alpha' into alpha

7bc5c36

Merge remote-tracking branch 'upstream/alpha' into alpha

7b2ab38

Merge remote-tracking branch 'upstream/alpha' into alpha

3c8f5cc

mtrezza added 2 commits February 9, 2023 14:53

Merge branch 'alpha' into forgotPassword

aa9abc9

Merge branch 'alpha' into forgotPassword

93687bc

mtrezza reviewed Feb 24, 2023

View reviewed changes

src/Options/index.js Outdated Show resolved Hide resolved

Update src/Options/index.js

1c67f00

Signed-off-by: Manuel <5673677+mtrezza@users.noreply.github.com>

mtrezza previously approved these changes Feb 24, 2023

View reviewed changes

mtrezza reviewed Feb 24, 2023

View reviewed changes

src/Options/Definitions.js Outdated Show resolved Hide resolved

mtrezza reviewed Feb 24, 2023

View reviewed changes

src/Options/docs.js Outdated Show resolved Hide resolved

mtrezza dismissed their stale review via 2115d36 February 24, 2023 18:42

mtrezza added 2 commits February 24, 2023 19:42

Update src/Options/docs.js

2115d36

Signed-off-by: Manuel <5673677+mtrezza@users.noreply.github.com>

Update src/Options/Definitions.js

1d77a97

Signed-off-by: Manuel <5673677+mtrezza@users.noreply.github.com>

mtrezza approved these changes Feb 24, 2023

View reviewed changes

mtrezza changed the title ~~feat: Allow transparent forgot password flow~~ feat: Add Parse Server option resetPasswordSuccessOnInvalidEmail to respond with error on password reset with invalid email Feb 24, 2023

mtrezza merged commit e5d610e into parse-community:alpha Feb 24, 2023

parseplatformorg added the state:released-alpha Released as alpha version label Feb 24, 2023

parseplatformorg added the state:released-beta Released as beta version label Mar 2, 2023

dblythy deleted the forgotPassword branch March 2, 2023 12:09

parseplatformorg added the state:released Released as stable version label May 1, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email #7551

feat: Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email #7551

dblythy commented Sep 6, 2021 •

edited by mtrezza

Loading

parse-github-assistant bot commented Sep 6, 2021 •

edited

Loading

codecov bot commented Sep 6, 2021 •

edited

Loading

mtrezza commented Sep 10, 2021

dblythy commented Sep 10, 2021

mtrezza commented Sep 10, 2021 •

edited

Loading

mtrezza commented Sep 10, 2021

mtrezza left a comment

mtrezza commented Feb 24, 2023 •

edited

Loading

parseplatformorg commented Feb 24, 2023

parseplatformorg commented Mar 2, 2023

parseplatformorg commented Mar 3, 2023

parseplatformorg commented May 1, 2023

feat: Add Parse Server option resetPasswordSuccessOnInvalidEmail to choose success or error response on password reset with invalid email #7551

feat: Add Parse Server option resetPasswordSuccessOnInvalidEmail to choose success or error response on password reset with invalid email #7551

Conversation

dblythy commented Sep 6, 2021 • edited by mtrezza Loading

New Pull Request Checklist

Issue Description

Approach

TODOs before merging

parse-github-assistant bot commented Sep 6, 2021 • edited Loading

Thanks for opening this pull request!

codecov bot commented Sep 6, 2021 • edited Loading

Codecov Report

mtrezza commented Sep 10, 2021

dblythy commented Sep 10, 2021

mtrezza commented Sep 10, 2021 • edited Loading

mtrezza commented Sep 10, 2021

mtrezza left a comment

Choose a reason for hiding this comment

mtrezza commented Feb 24, 2023 • edited Loading

parseplatformorg commented Feb 24, 2023

parseplatformorg commented Mar 2, 2023

parseplatformorg commented Mar 3, 2023

parseplatformorg commented May 1, 2023

feat: Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email #7551

feat: Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email #7551

dblythy commented Sep 6, 2021 •

edited by mtrezza

Loading

parse-github-assistant bot commented Sep 6, 2021 •

edited

Loading

codecov bot commented Sep 6, 2021 •

edited

Loading

mtrezza commented Sep 10, 2021 •

edited

Loading

mtrezza commented Feb 24, 2023 •

edited

Loading