search

nextcloud / server

☁️ Nextcloud server, a safe home for all your data
https://nextcloud.com
GNU Affero General Public License v3.0
27.16k stars 4.03k forks source link

Users uniformed about using wrong name when trying to reset password #16941

Closed rollanders closed 5 years ago

rollanders commented 5 years ago

<### Steps to reproduce

  1. Write/misspel the username. You can write anything in the box
  2. Press "Forgot the password"
  3. You get an information that an e-mail has been sent to the e-mailadress asociated with the name
  4. The admin find an error In the log-file that no e-mail was sent

Expected behaviour

1 and 2 same 3 I should get a message that there was no e-mailadress associated with the name and a question if I had misspelled it or used a wrongname

Actual behaviour

  1. You get an information that an e-mail has been sent to the e-mailadress asociated with the name
  2. The admin find an error In the log-file that no e-mail was sent

Server configuration detail

Operating system: Linux 4.15.0-50-generic #54-Ubuntu SMP Mon May 6 18:46:08 UTC 2019 x86_64

Webserver: nginx/1.15.9 (fpm-fcgi)

Database: mysql 10.3.15

PHP version:

7.3.5-1+ubuntu18.04.1+deb.sury.org+1 Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, sodium, session, standard, cgi-fcgi, mysqlnd, PDO, xml, apcu, bz2, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, iconv, igbinary, imagick, intl, json, ldap, exif, mysqli, pdo_mysql, apc, posix, readline, redis, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, Phar, Zend OPcache

Nextcloud version: 16.0.3 - 16.0.3.0

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from: unknown

Signing status Array ( )
List of activated apps ``` Enabled: - activity: 2.9.1 - admin_audit: 1.6.0 - apporder: 0.7.1 - calendar: 1.7.0 - circles: 0.17.7 - cloud_federation_api: 0.2.0 - cms_pico: 0.9.8 - comments: 1.6.0 - contacts: 3.1.3 - dav: 1.9.2 - external: 3.3.0 - federatedfilesharing: 1.6.0 - files: 1.11.0 - files_external_onedrive: 1.0.4 - files_markdown: 2.0.6 - files_pdfviewer: 1.5.0 - files_readmemd: 1.1.1 - files_rightclick: 0.15.1 - files_sharing: 1.8.0 - files_texteditor: 2.8.0 - files_trashbin: 1.6.0 - files_versions: 1.9.0 - groupfolders: 4.1.0 - issuetemplate: 0.5.0 - logreader: 2.1.0 - lookup_server_connector: 1.4.0 - mail: 0.15.1 - notes: 3.0.1 - oauth2: 1.4.2 - onlyoffice: 2.4.0 - password_policy: 1.6.0 - provisioning_api: 1.6.0 - registration: 0.4.7 - richdocuments: 3.3.15 - sharebymail: 1.6.0 - theming: 1.7.0 - theming_customcss: 1.3.0 - twofactor_backupcodes: 1.5.0 - updatenotification: 1.6.0 - workflowengine: 1.6.0 Disabled: - accessibility - announcementcenter - audioplayer - carnet - encryption - federation - files_clipboard - files_external - files_videoplayer - firstrunwizard - gallery - group_everyone - nextcloud_announcements - notifications - polls - privacy - recommendations - serverinfo - support - survey_client - suspicious_login - systemtags - user_ldap - viewer ```
Configuration (config/config.php) ``` { "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "vmi259531.contaboserver.net", "korskyrkan-intra.se" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "16.0.3.0", "overwrite.cli.url": "https:\/\/korskyrkan-intra.se", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": "***REMOVED SENSITIVE VALUE***", "activity_expire_days": 14, "auth.bruteforce.protection.enabled": true, "blacklisted_files": [ ".htaccess", "Thumbs.db", "thumbs.db" ], "cron_log": true, "defaultapp": "apporder", "enable_previews": true, "enabledPreviewProviders": [ "OC\\Preview\\PNG", "OC\\Preview\\JPEG", "OC\\Preview\\GIF", "OC\\Preview\\BMP", "OC\\Preview\\XBitmap", "OC\\Preview\\Movie", "OC\\Preview\\PDF", "OC\\Preview\\MP3", "OC\\Preview\\TXT", "OC\\Preview\\MarkDown" ], "filesystem_check_changes": 0, "filelocking.enabled": "true", "htaccess.RewriteBase": "\/", "integrity.check.disabled": false, "knowledgebaseenabled": false, "log_rotate_size": 104857600, "logfile": "\/var\/nc_data\/nextcloud.log", "logtimezone": "Europe\/Berlin", "memcache.local": "\\OC\\Memcache\\APCu", "memcache.locking": "\\OC\\Memcache\\Redis", "preview_max_x": 1024, "preview_max_y": 768, "preview_max_scale_factor": 1, "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": 0, "timeout": 0 }, "rewrite_url": true, "quota_include_external_storage": false, "share_folder": "\/Shares", "skeletondirectory": "", "trashbin_retention_obligation": "auto, 7", "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_smtpmode": "smtp", "mail_sendmailmode": "smtp", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_smtpauthtype": "PLAIN", "mail_smtpauth": 1, "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "mail_smtpport": "587", "mail_smtpname": "***REMOVED SENSITIVE VALUE***", "mail_smtppassword": "***REMOVED SENSITIVE VALUE***", "maintenance": false, "theme": "", "loglevel": 2, "app_install_overwrite": [ "files_clipboard", "files_reader" ], "has_rebuilt_cache": true } ```

Are you using external storage, if yes which one: local/smb/sftp/...

Are you using encryption:

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...

Client configuration

Browser: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36

Operating system: windows 10

Logs

Web server error log ``` {"reqId":"RhqBZS1cLLTvLB3Qe0WR","level":2,"time":"2019-08-30T20:25:28+02:00","remoteAddr":"xxxxxxxxxxxxx","user":"--","app":"core","method":"POST","url":"/lostpassword/email","message":{"Exception":"InvalidArgumentException","Message":"Kunde inte skicka återställningsmejl. Vänligen kontrollera att ditt användarnamn är korrekt.","Code":0,"Trace":[{"file":"/var/www/nextcloud/core/Controller/LostController.php","line":315,"function":"findUserByIdOrMail","class":"OC\\Core\\Controller\\LostController","type":"->","args":["rolan D"]},{"file":"/var/www/nextcloud/core/Controller/LostController.php","line":247,"function":"sendEmail","class":"OC\\Core\\Controller\\LostController","type":"->","args":["rolan D"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":166,"function":"email","class":"OC\\Core\\Controller\\LostController","type":"->","args":["rolan D"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":99,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OC\\Core\\Controller\\LostController"},"email"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":126,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OC\\Core\\Controller\\LostController"},"email"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OC\\Core\\Controller\\LostController","email",{"__class__":"OC\\AppFramework\\DependencyInjection\\DIContainer"},{"_route":"core.lost.email"}]},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->","args":[{"_route":"core.lost.email"}]},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":297,"function":"call_user_func","args":[{"__class__":"OC\\AppFramework\\Routing\\RouteActionHandler"},{"_route":"core.lost.email"}]},{"file":"/var/www/nextcloud/lib/base.php","line":975,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/lostpassword/email"]},{"file":"/var/www/nextcloud/index.php","line":42,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/nextcloud/core/Controller/LostController.php","Line":379,"CustomMessage":"--"},"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36","version":"16.0.3.0","id":"5d696c2b06cc9"}Insert your web server log here ```
Nextcloud log ``` ```
Browser log Insert your browser log here, this could for example include: a) The javascript console log b) The network log c) ...
kesselb commented 5 years ago

This is by design: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#password-recovery

ghost commented 5 years ago

This issue has been automatically marked as stale because it has not had recent activity and seems to be missing some essential information. It will be closed if no further activity occurs. Thank you for your contributions.