rodrigo/iachat
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
f4538ae2c5
iachat/config/locales
History
João Pedro Baza Garcia Rodrigues 4d362da9f0
fix: Prevent user enumeration on password reset endpoint (#13528) 
## Description

The current password reset endpoint returns different HTTP status codes
and messages depending on whether the email exists in the system (200
for existing emails, 404 for non-existing ones). This allows attackers
to enumerate valid email addresses via the password reset form.

## Changes

### `app/controllers/devise_overrides/passwords_controller.rb`
- Removed the `if/else` branch that returned different responses based
on email existence
- Now always returns a generic `200 OK` response with the same message
regardless of whether the email exists
- Uses safe navigation operator (`&.`) to send reset instructions only
if the user exists

### `config/locales/en.yml`
- Consolidated `reset_password_success` and `reset_password_failure`
into a single generic `reset_password` key
- New message does not reveal whether the email exists in the system

## Security Impact
- **Before**: An attacker could determine if an email was registered by
observing the HTTP status code (200 vs 404) and response message
- **After**: All requests receive the same 200 response with a generic
message, preventing user enumeration

This follows [OWASP guidelines for authentication error
messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-responses).

Fixes #13527
2026-02-13 13:45:40 +05:30
..
am.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ar.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
az.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
bg.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
bn.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ca.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
cs.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
da.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
de.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
devise.am.yml chore: Update translations (#7728) 2023-08-15 13:47:38 -07:00
devise.ar.yml chore: Update translations (#9946) 2024-08-16 14:06:32 +05:30
devise.az.yml chore: Update translations (#10549) 2025-01-14 22:00:56 +05:30
devise.bg.yml
devise.bn.yml chore: Update translations (#12722) 2025-10-27 17:54:15 +05:30
devise.ca.yml
devise.cs.yml
devise.da.yml
devise.de.yml
devise.el.yml
devise.en.yml
devise.es.yml
devise.et.yml chore: Update translations (#12722) 2025-10-27 17:54:15 +05:30
devise.fa.yml
devise.fi.yml
devise.fr.yml
devise.he.yml chore: Update translations (#6895) 2023-04-17 14:45:49 +05:30
devise.hi.yml
devise.hr.yml chore: Update translations (#9946) 2024-08-16 14:06:32 +05:30
devise.hu.yml
devise.hy.yml chore: Update translations 2023-03-08 14:00:00 +05:30
devise.id.yml
devise.is.yml chore: Update translations from Crowdin (#5810) 2022-11-08 09:36:24 -08:00
devise.it.yml
devise.ja.yml chore: Update translations from Crowdin (#10686) 2025-02-12 12:34:34 +05:30
devise.ka.yml chore: Enable Thai language (th), update translations (#5095) 2022-07-26 09:52:59 +05:30
devise.ko.yml chore: Update translations from Crowdin (#5810) 2022-11-08 09:36:24 -08:00
devise.lt.yml chore: Update translations (#7347) 2023-06-19 17:27:43 +05:30
devise.lv.yml chore: Update translations from Crowdin (#5523) 2022-09-28 21:59:41 -07:00
devise.ml.yml
devise.ms.yml chore: New Translation updates (#5287) 2022-08-19 13:55:23 +05:30
devise.ne.yml
devise.nl.yml
devise.no.yml
devise.pl.yml
devise.pt_BR.yml
devise.pt.yml
devise.ro.yml
devise.ru.yml
devise.sh.yml chore: Update translations (#6751) 2023-03-27 14:45:50 +05:30
devise.sk.yml
devise.sl.yml chore: Update translations (#10549) 2025-01-14 22:00:56 +05:30
devise.sq.yml chore: Update translations (#8016) 2023-09-29 15:46:29 +05:30
devise.sr.yml chore: Update translations from Crowdin (#5202) 2022-08-08 21:14:50 +05:30
devise.sv.yml
devise.ta.yml
devise.th.yml
devise.tl.yml chore: Update translations from Crowdin (#9835) 2024-07-25 11:58:22 -07:00
devise.tr.yml
devise.uk.yml
devise.ur_IN.yml chore: Update translations from Crowdin (#4665) 2022-05-13 11:38:49 +05:30
devise.ur.yml
devise.vi.yml
devise.zh_CN.yml
devise.zh_TW.yml
devise.zh.yml
el.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
en.yml fix: Prevent user enumeration on password reset endpoint (#13528) 2026-02-13 13:45:40 +05:30
es.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
et.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
fa.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
fi.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
fr.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
he.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
hi.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
hr.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
hu.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
hy.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
id.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
is.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
it.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ja.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ka.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ko.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
lt.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
lv.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ml.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ms.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ne.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
nl.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
no.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
pl.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
pt_BR.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
pt.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ro.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ru.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
secure_password.en.yml
sh.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
sk.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
sl.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
sq.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
sr.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
sv.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ta.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
th.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
tl.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
tr.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
uk.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ur_IN.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
ur.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
vi.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
zh_CN.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
zh_TW.yml chore: Update translations (#13109) 2026-01-09 16:11:44 -08:00
zh.yml