mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
Livio SpringandGitHub
ffe6d41588
# Which Problems Are Solved When authenticating with email or phone number in the login V1, users were not able to request a password reset and would be given a "User not found" error. This was due to a check of the loginname of the auth request, which in those cases would not match the user's stored loginname. # How the Problems Are Solved Switch to a check of the resolved userID in the auth request. (We still check the user again, since the ID might be a placeholder for an unknown user and we do not want to disclose any information by omitting a check and reduce the response time.) # Additional Changes None # Additional Context - reported through support - requires backport to v3.x
41 lines
1.5 KiB
Go
41 lines
1.5 KiB
Go
package login
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
const (
|
|
tmplPasswordResetDone = "passwordresetdone"
|
|
)
|
|
|
|
func (l *Login) handlePasswordReset(w http.ResponseWriter, r *http.Request) {
|
|
authReq, err := l.ensureAuthRequest(r)
|
|
if err != nil {
|
|
l.renderError(w, r, authReq, err)
|
|
return
|
|
}
|
|
// We check if the user really exists or if it is just a placeholder or an unknown user.
|
|
// In theory, we could also check for the unknownUserID constant. However, that could disclose
|
|
// information about the existence of a user to an attacker if they check response times,
|
|
// since those requests would take shorter than the ones for real users.
|
|
user, err := l.query.GetUserByID(setContext(r.Context(), authReq.UserOrgID), true, authReq.UserID)
|
|
if err != nil {
|
|
if authReq.LoginPolicy.IgnoreUnknownUsernames && zerrors.IsNotFound(err) {
|
|
err = nil
|
|
}
|
|
l.renderPasswordResetDone(w, r, authReq, err)
|
|
return
|
|
}
|
|
_, err = l.command.RequestSetPassword(setContext(r.Context(), authReq.UserOrgID), user.ID, authReq.UserOrgID, domain.NotificationTypeEmail, authReq.ID)
|
|
l.renderPasswordResetDone(w, r, authReq, err)
|
|
}
|
|
|
|
func (l *Login) renderPasswordResetDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, err error) {
|
|
translator := l.getTranslator(r.Context(), authReq)
|
|
data := l.getUserData(r, authReq, translator, "PasswordResetDone.Title", "PasswordResetDone.Description", err)
|
|
l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplPasswordResetDone], data, nil)
|
|
}
|