avoid exposing registered email addresses

This commit is contained in:
Athou
2022-07-13 13:28:07 +02:00
parent d82bb22341
commit 9bbfc2de3f
2 changed files with 3 additions and 2 deletions

View File

@@ -259,8 +259,9 @@ public class UserREST {
public Response sendPasswordReset(@Valid @ApiParam(required = true) PasswordResetRequest req) {
User user = userDAO.findByEmail(req.getEmail());
if (user == null) {
return Response.status(Status.PRECONDITION_FAILED).entity("Email not found.").type(MediaType.TEXT_PLAIN).build();
return Response.ok().build();
}
try {
user.setRecoverPasswordToken(DigestUtils.sha1Hex(UUID.randomUUID().toString()));
user.setRecoverPasswordTokenDate(new Date());