search

michaellaunay / alirpunkto

0 stars 0 forks source link

The text of the e-mail to confirm the change in e-mail address should contain the new e-mail address for the user to confirm #125

Closed SergioArbarviro closed 4 months ago

SergioArbarviro commented 4 months ago

Current situation

The text of the current e-mail to confirm the change in e-mail address (contained in the check_new_email.pt message), does not present to the legitimate user the new e-mail address that the IT infrastructure has been requested to use in the future.

This is a security gap, because the legitimate user can click on the confirmation link without paying much attention to it, and the usurpator of his/her identity on the platform (which has stolen the legitimate user's pseudonym and password) has breached the last link between the legitimate user and his/her account, as described in Issue #124.

Desired situation

The text of the e-mail should clearly display the new e-mail address, i.e. the one to be used in the future, so that the legitimate user has a clear view on the decision that s/he takes by clicking (or not) on the proposed link.

SergioArbarviro commented 4 months ago

Fixed by commits listed above.