Lost pass disclosure fix (#89)

FIX for issue #88 response from RESTfulAPI_TokenAuthenticator::lostPassword() is now the same regardless whether an email was sent or not
colymba · Jan 4, 2018 · 3463f4e · 3463f4e
1 parent 5833442
commit 3463f4e
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/code/authenticator/RESTfulAPI_TokenAuthenticator.php b/code/authenticator/RESTfulAPI_TokenAuthenticator.php
@@ -217,7 +217,6 @@ public function lostPassword(SS_HTTPRequest $request)
   {
       $email = Convert::raw2sql($request->requestVar('email'));
       $member = DataObject::get_one('Member', "\"Email\" = '{$email}'");
-      $sent = true;
 
       if ($member) {
           $token = $member->generateAutologinTokenAndStoreHash();
@@ -228,10 +227,10 @@ public function lostPassword(SS_HTTPRequest $request)
         'PasswordResetLink' => Security::getPasswordResetLink($member, $token)
       ));
           $e->setTo($member->Email);
-          $sent = $e->send();
+          $e->send();
       }
 
-      return array( 'email' => $sent );
+      return array( 'done' => true );
   }