Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #44865 Lost password feature "doesn't work"
    Actions
    Infos
    #44865
    Aurélien Tisné (atisne)
    2025-10-01 09:42
    2025-09-26 09:02
    46575
    Details
    Lost password feature "doesn't work"

    When you ask to reset a password using a wrong username or if the account has no password, Tuleap does nothing and displays the same page as it succeed.

    We propose to log information to help administrators to diagnose this cases.

    Authentication & LDAP
    16.11
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2025-10-01
    Attachments
    Empty
    References
    Referencing request #44865

    Git commit

    tuleap/tuleap/stable

    feat: Logs more information during password recovery process 68b7e192d2
    User avatar Thomas Gerbet (tgerbet) , 2025-09-30 16:40
    Display settings

    Follow-ups

    User avatar
    Joris MASSON (jmasson)2025-10-01 09:42

    Thanks, I'll mark this as closed then. Have a nice day !

    • Status changed from Under review to Closed
    • Connected artifacts
    • Close date set to 2025-10-01
    User avatar
    Aurélien Tisné (atisne)2025-09-26 11:55

    Yes I know. Safety is done at the expense of the user experience. Thank you the black hats.

    Thank you to validate the change and help admins ;-)

    User avatar
    Thomas Gerbet (tgerbet)2025-09-26 11:34

    When you ask to reset a password using a wrong username or if the account has no password, Tuleap does nothing and displays the same page as it succeed.

    To be fair this is done this way because there is no real other options for these situations. Tuleap cannot leak information about this to unauthenticated users without making pentesters unhappy and requesting CVE IDs :) (request #43674).

    Please consider gerrit #35694

    Thanks for this, I have pushed gerrit #35697 so we can distinguish the different cases.

    • Status changed from New to Under implementation