[BUGFIX] Fix success message of password reset command
To prevent information disclosure, the password reset process does not reveal if an email was sent or not. The corresponding methods just return void. However, the ResetPasswordCommand always displayed a success message, which claims an email was sent, even though this was not the case. An example would be a password reset request which affects an admin user, while "passwordResetForAdmins" is disabled. In such cases, the message is highly misleading. To fix this, the message now only informs about the successfully initiated password reset process and not whether an email was sent or not. This is now consistent with the message in the backend user module. Resolves: #94200 Releases: master, 10.4 Change-Id: I99d33d0a55be48c7f5ee51e24fea3f85baf36b26 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69270 Tested-by:core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Jochen <rothjochen@gmail.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Jochen <rothjochen@gmail.com> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
parent
7a503f6b
Please register or sign in to comment