#31505: Document possible email address enumeration in PasswordResetView.
-------------------------------------+-------------------------------------
Reporter: Mohammad Almazroa | Owner: felixxm
Type: | Status: assigned
Cleanup/optimization |
Component: Documentation | Version: 3.0
Severity: Normal | Resolution:
Keywords: User Enumeration | Triage Stage: Accepted
Security Bug |
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Mohammad Almazroa):
Replying to [comment:1 felixxm]:
> First of all, please note that security issues
[https://docs.djangoproject.com/en/stable/internals/security/#reporting-
security-issues should be privately sent] to secur...@djangoproject.com
and never on public issue trackers.
>
> Your analysis is correct, however `PasswordResetView` sends an email
which always take an extra time. We don't know how much it takes so adding
a fixed delay is impossible and for a random sleep time you'd just need a
bit of statistic to figure it out.
>
> I think we could document this potential account existence leak in
[https://docs.djangoproject.com/en/3.0/topics/auth/default/#django.contrib.auth.views.PasswordResetView
PasswordResetView].
Really sorry that I reported it publicly here.
--
Ticket URL: <https://code.djangoproject.com/ticket/31505#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.ac01f442bf2c15eeb8f80087e4f0c6cc%40djangoproject.com.
