Changes to password reset process in Drupal 7 to prevent email or username enumeration

Background information about this change

This is a backport of #1521996: Password reset form reveals whether an email or username is in use that has been committed to Drupal 9.

An excerpt from the original issue summary explains:

The actual password reset mechanism exposes a user enumeration security vulnerability defined as Testing for User Enumeration and Guessable User Account (OWASP-AT-002) by OWASP - Open Web Application Security Project.

Along with the security aspect comes also the privacy side.

The change involves the following:
1. Removal of message from validateForm that displays user name and/or email.
2. Change to message in submitForm to display user input so they can check for typos with a general statement, "if it is valid an email is sent".
3. Addition of watchdog messages.

Installation and setup instructions

No special installation or setup is required. However, if the contrib module Username Enumeration Prevention has been enabled on the site it will override the core changes and will use the message from the contrib module and not make a watchdog entry. Sites with this module enabled should review whether this change to core means the module is no longer required and can be uninstalled.

User Interface changes

The password reset form no longer indicates whether the provided username or email address is in the database. This changes the user interface such that the same message is displayed regardless of whether the user exists, is active or blocked.

Also user profiles are changed from 403 Access Denied to 404 Not Found.

This may decrease usability for users when resetting their password with the wrong email address leaving them wondering why they never get an email. Previously, the user would know immediately they typed in a wrong email address.

To avoid https://owasp.org/www-community/attacks/Content_Spoofing and to partially mitigate the UX regression that there's no feedback if you're typing something invalid, the form now at least validates that the input is either a valid username or a valid email address. If the input is neither, the user gets a validation error message about it (since that's not a privacy violation).

Any decreased usability vs. better privacy is probably a trade-off we accept.