Skip to content
Snippets Groups Projects
Commit de8529b0 authored by Oliver Bartsch's avatar Oliver Bartsch
Browse files

[BUGFIX] Fix success message of password reset command

To prevent information disclosure, the password reset
process does not reveal if an email was sent or not. The
corresponding methods just return void.

However, the ResetPasswordCommand always displayed
a success message, which claims an email was sent,
even though this was not the case. An example would be
a password reset request which affects an admin user,
while "passwordResetForAdmins" is disabled.

In such cases, the message is highly misleading.

To fix this, the message now only informs about the
successfully initiated password reset process and not
whether an email was sent or not. This is now consistent
with the message in the backend user module.

Resolves: #94200
Releases: master, 10.4
Change-Id: I99d33d0a55be48c7f5ee51e24fea3f85baf36b26
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69270


Tested-by: default avatarcore-ci <typo3@b13.com>
Tested-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
Tested-by: default avatarJochen <rothjochen@gmail.com>
Tested-by: default avatarOliver Bartsch <bo@cedev.de>
Reviewed-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: default avatarJochen <rothjochen@gmail.com>
Reviewed-by: default avatarOliver Bartsch <bo@cedev.de>
parent 7a503f6b
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment