Chris Hill-Scott e0e445c520 Stop enumeration of email addresses via forgot pw ...

https://www.pivotaltracker.com/story/show/113840073

Previously the forgot password page would give an error if you entered an email
address which didn’t belong to an account.

This would allow a potential attacker to know which email addresses were
registered.

This commit changes the response to always be the same, whether or not the email
address exists.

Also, this is a good read about the dangers of asserting whether a mocked method
was called: http://engineeringblog.yelp.com/2015/02/assert_called_once-threat-or-menace.html

2016-02-17 10:42:15 +00:00

..

assets

Remove ‘info’ banner type

2016-02-15 11:37:40 +00:00

main

Stop enumeration of email addresses via forgot pw

2016-02-17 10:42:15 +00:00

notify_client

Merge pull request #172 from alphagov/upgrade_notifications_python_client

2016-02-12 09:46:15 +00:00

status

…

templates

Use typographic quotes

2016-02-17 10:42:14 +00:00

__init__.py

Make URLs for assets cache-proof

2016-02-10 16:00:29 +00:00

asset_fingerprinter.py

Make URLs for assets cache-proof

2016-02-10 16:00:29 +00:00

its_dangerous_session.py

Fix for bug of cookie expiry.

2016-02-15 11:43:16 +00:00

proxy_fix.py

…

version.py

…