#26012: Provide an error message during password reset if email doesn't exist
--------------------------------+--------------------------------------
Reporter: nauman3128 | Owner: nobody
Type: Bug | Status: closed
Component: contrib.auth | Version: 1.8
Severity: Normal | Resolution: invalid
Keywords: password reset | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------+--------------------------------------
Changes (by timgraham):
* status: new => closed
* resolution: => invalid
Comment:
As noted
[https://docs.djangoproject.com/en/dev/topics/auth/default/#django.contrib.auth.views.password_reset
in the documentation]:
If the email address provided does not exist in the system, this view
won’t send an email, but the user won’t receive any error message either.
This prevents information leaking to potential attackers. If you want to
provide an error message in this case, you can subclass
`PasswordResetForm` and use the `password_reset_form` argument.
--
Ticket URL: <https://code.djangoproject.com/ticket/26012#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.6ba80ce6db8ebb8d0e55569e5fe072f9%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
