Forgot Password dialog presents empty security question if none is set

HOW TO REPRODUCE: A user enters an alternate_email but no s

Tue, 16 Aug 2011 10:52:36 +0000

HOW TO REPRODUCE: A user enters an alternate_email but no security question/answer. He logs out and clicks "Forgot password". He provides username and alternate email. EFFECT: He is presented an empty security question and an answer field which does not accept any input (empty line complains about "required", any input would not match backend content. EXPECTED BEHAVIOUR: Either do not present security question if none is set or forbid reset self service if none is set. I would go for the former though there is a slight potential of DoS in setups where alternate_email is auto-set/required. ACTION: I would patch that according to "do not present security question if none is set ". Please post any disagreements.

Changes have been made in Git for this ticket: [rla] Don't

Tue, 16 Aug 2011 14:19:03 +0000

Changes have been made in Git for this ticket: [rla] Don't present security question dialog if none is set #10430 1 files changed, 8 insertions(+), 5 deletions(-) http://git.horde.org/horde-git/-/commit/98e7ed658b56dbbdaafcf321b459652a8cd75ef2

Changes have been made in Git for this ticket: [rla] Don't

Tue, 16 Aug 2011 14:19:11 +0000

Changes have been made in Git for this ticket: [rla] Don't present security question dialog if none is set #10430 2 files changed, 3 insertions(+), 2 deletions(-) http://git.horde.org/horde-git/-/commit/84e8bd5b011c31ba6b071864f65c989b3acae1f3

Changes have been made in Git for this ticket: Revert "[rla

Tue, 16 Aug 2011 15:02:10 +0000

Changes have been made in Git for this ticket: Revert "[rla] Don't present security question dialog if none is set #10430" This is contested on and wrong branch anyway This reverts commit 84e8bd5b011c31ba6b071864f65c989b3acae1f3. This reverts commit 98e7ed658b56dbbdaafcf321b459652a8cd75ef2. 3 files changed, 7 insertions(+), 11 deletions(-) http://git.horde.org/horde-git/-/commit/14b5e0749000e0d5740a93e816c1e212e99390dc

Changes have been made in Git for this ticket: [rla] Reset

Wed, 17 Aug 2011 14:41:50 +0000

Changes have been made in Git for this ticket: [rla] Reset password dialog shows a warning when no security question is set #10430 3 files changed, 7 insertions(+), 2 deletions(-) http://git.horde.org/horde-git/-/commit/c05dbf0330f21de8d6ffad6098ba7af3db85ba11

It was decided that skipping security question is unsafe.

Wed, 17 Aug 2011 14:43:38 +0000

It was decided that skipping security question is unsafe. Users now get a warning if no security question is set when they try to reset their password.