Chris Hill-Scott e0e445c520 Stop enumeration of email addresses via forgot pw ...

https://www.pivotaltracker.com/story/show/113840073

Previously the forgot password page would give an error if you entered an email
address which didn’t belong to an account.

This would allow a potential attacker to know which email addresses were
registered.

This commit changes the response to always be the same, whether or not the email
address exists.

Also, this is a good read about the dangers of asserting whether a mocked method
was called: http://engineeringblog.yelp.com/2015/02/assert_called_once-threat-or-menace.html

2016-02-17 10:42:15 +00:00

..

__init__.py

Updated generate_token to use encrypt the entire url.

2016-01-11 15:18:37 +00:00

_jobs.py

Make data consistent from dashboard -> job

2016-01-05 13:31:54 +00:00

add_service.py

Updates to ‘send SMS’ page

2016-02-04 14:06:19 +00:00

api_keys.py

Use banners appropriately

2016-02-05 10:43:49 +00:00

choose_service.py

Move service and user nav to proposition header

2016-02-01 13:52:45 +00:00

code_not_received.py

All tests passing and merged with master.

2016-01-27 16:30:33 +00:00

dashboard.py

notifications-python_client upgraded to 0.2.5

2016-02-11 15:27:08 +00:00

forgot_password.py

Stop enumeration of email addresses via forgot pw

2016-02-17 10:42:15 +00:00

index.py

Add manage users page

2016-02-03 17:08:58 +00:00

jobs.py

notifications-python_client upgraded to 0.2.5

2016-02-11 15:27:08 +00:00

new_password.py

Fix for forgotten password.

2016-02-11 15:59:28 +00:00

register.py

notifications-python_client upgraded to 0.2.5

2016-02-11 15:27:08 +00:00

service_settings.py

notifications-python_client upgraded to 0.2.5

2016-02-11 15:27:08 +00:00

sign_in.py

Tests fixed.

2016-02-11 16:04:50 +00:00

sign_out.py

Use session.clear() sign-out.

2016-02-12 15:06:54 +00:00

sms.py

notifications-python_client upgraded to 0.2.5

2016-02-11 15:27:08 +00:00

styleguide.py

Don’t show styleguide on live environment

2016-02-15 11:48:04 +00:00

templates.py

notifications-python_client upgraded to 0.2.5

2016-02-11 15:27:08 +00:00

two_factor.py

Skip ‘choose service’ page if user has one service

2016-02-05 14:50:55 +00:00

user_profile.py

Fix for forgot my password.

2016-01-27 18:01:43 +00:00

verify.py

notifications-python_client upgraded to 0.2.5

2016-02-11 15:27:08 +00:00