Ryan/documenso
1
0
Fork 1
mirror of https://github.com/documenso/documenso.git synced 2025-11-10 04:22:32 +10:00
Code Issues Packages Projects Releases Wiki Activity

Avoid leaking that a user has an account

Browse Source
This commit is contained in:
Ephraim Atta-Duncan
2023-06-07 10:59:20 +00:00
parent 9dd8c2842c
commit 9cfbb1dec9
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/web/pages/api/auth/forgot-password.ts
View File

@ -20,7 +20,7 @@ async function postHandler(req: NextApiRequest, res: NextApiResponse) {
});
if (!user) {
return res.status(404).json({ message: "No user found with this email" });
return res.status(200).json({ message: "A password reset email has been sent." });
}
const existingToken = await prisma.passwordResetToken.findFirst({
@ -33,7 +33,7 @@ async function postHandler(req: NextApiRequest, res: NextApiResponse) {
});
if (existingToken) {
return res.status(400).json({ message: "Password reset requested." });
return res.status(200).json({ message: "A password reset email has been sent." });
}
const token = crypto.randomBytes(64).toString("hex");
@ -55,7 +55,7 @@ async function postHandler(req: NextApiRequest, res: NextApiResponse) {
await sendResetPassword(user, passwordResetToken.token);
res.status(200).json({ message: "Password reset email sent." });
return res.status(200).json({ message: "A password reset email has been sent." });
}
export default defaultHandler({