By larowlan on
Change record status:
Published (View all published change records)
Project:
Introduced in branch:
10.2.x
Introduced in version:
10.2.0
Issue links:
Description:
If a user fails to login, the error message includes a link to 'reset your password;.
Prior to 10.2.0 the URL for the reset link included the username of the failed login. Clicking this link could lead to the username being disclosed to third-party services such as analytics services.
From 10.2.0 the link doesn't include the username and hence the username is no longer prefilled on the password reset form.
Impacts:
Site builders, administrators, editors
