6232e9676c
Summary: Via HackerOne. If a user adds an email address and typos it, entering `alinculne@gmailo.com`, and it happens to be a valid address which an evil user controls, the evil user can request a password reset and compromise the account. This strains the imagination, but we can implement a better behavior cheaply. - If an account has any verified addresses, only send to verified addresses. - If an account has no verified addresses (e.g., is a new account), send to any address. We've also received several reports about reset links not being destroyed as aggressively as researchers expect. While there's no specific scenario where this does any harm, revoke all outstanding reset tokens when a reset link is used to improve the signal/noise ratio of the reporting channel. Test Plan: - Tried to send a reset link to an unverified address on an account with a verified address (got new error). - Tried to send a reset link to a verified adddress on an account with a verified address (got email). - Tried to send a reset link to an invalid address (got old error). - Tried to send a reset link to an unverified address on an account with only unverified addresses -- a new user (got email). - Requested several reset links, used one, verified all the others were revoked. Reviewers: btrahan Reviewed By: btrahan Subscribers: epriestley Differential Revision: https://secure.phabricator.com/D10206
Phabricator is an open source collection of web applications which help software companies build better software. Phabricator includes applications for: - reviewing and auditing source code; - hosting and browsing repositories; - assembling a party to venture forth; - tracking bugs; - hiding stuff from coworkers; and - also some other things. You can learn more about the project (and find links to documentation and resources) [[http://phabricator.org/ | here]]. Phabricator is developed and maintained by [[http://phacility.com/ | Phacility]]. The first version of Phabricator was originally built at Facebook. = LICENSE = Phabricator is released under the Apache 2.0 license except as otherwise noted.