Fixing information disclosure when resetting password

2015-05-05 19:52:23 +02:00 · 2015-05-05 19:52:23 +02:00 · c2563125e5
parent 9c1c582577
commit c2563125e5
1 changed files with 1 additions and 2 deletions
--- a/taiga/users/api.py
+++ b/taiga/users/api.py
@ -100,8 +100,7 @@ class UsersViewSet(ModelCrudViewSet):
        email = mbuilder.password_recovery(user.email, {"user": user})
        email.send()

-        return response.Ok({"detail": _("Mail sended successful!"),
-                            "email": user.email})
+        return response.Ok({"detail": _("Mail sended successful!")})

    @list_route(methods=["POST"])
    def change_password_from_recovery(self, request, pk=None):