Currently the user form is altered to prevent the entering of passwords locally. Which is excellent and works.
But this prevention is not implemented on the password reset page.

Fix would be to add a form validation to check the entered name/email, using the same validation that is used on the form alters for the user edit pages.

CommentFileSizeAuthor
#5 openid_connect-add_validation_to_password_reset_form-3071318-5.patch2.32 KBthomasdik
#4 openid_connect-add_validation_to_password_reset_form-3071318-4.patch2.48 KBjefuri
#3 openid_connect-add_validation_to_password_reset_form-3071318-3.patch2.48 KBjefuri
#2 openid_connect-add_validation_to_password_reset_form-3071318-2.patch2.49 KBjefuri

Comments

jefuri created an issue. See original summary.

jefuri’s picture

jefuri commented
StatusFileSize
new openid_connect-add_validation_to_password_reset_form-3071318-2.patch2.49 KB
jefuri’s picture

jefuri commented
StatusFileSize
new openid_connect-add_validation_to_password_reset_form-3071318-3.patch2.48 KB
jefuri’s picture

jefuri commented
Status: Active » Needs review
StatusFileSize
new openid_connect-add_validation_to_password_reset_form-3071318-4.patch2.48 KB
thomasdik’s picture

thomasdik commented
StatusFileSize
new openid_connect-add_validation_to_password_reset_form-3071318-5.patch2.32 KB
jcnventura’s picture

jcnventura
Primary language English
commented
Assigned: jefuri » Unassigned

Let's assume that after all this time, there's no reason to keep it assigned.

mcdruid’s picture

mcdruid commented

Unpublishing as this is similar to SA-CONTRIB-2021-006 and will be discussed in the private security issue tracker for now.

  • jcnventura committed 9cedfc0 on 8.x-1.x 
    Issue #3071318 by jefuri, ThomasDik, jcnventura, pfrilling: Add...

  • jcnventura committed a324815 on 7.x-1.x 
    Issue #3071318 by jefuri, ThomasDik, jcnventura, pfrilling: Add...

  • jcnventura committed 7a08e96 on 2.x 
    Issue #3071318 by jefuri, ThomasDik, jcnventura, pfrilling: Add...
gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented
gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented
drumm’s picture

drumm
he/him
Location NY, US
commented
Status: Needs review » Fixed

Publishing since this was fixed with https://www.drupal.org/sa-contrib-2021-014

Please report potential security issues confidentially in the future.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.