groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-07-27 11:41:36 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Ensure that the Password reset link is generated on a trusted domain, and cannot be manipulated by an attacker by setting the host header

Browse source
This commit is contained in:
Jan Böhmer 2026-07-19 23:05:02 +02:00
parent 3f7dd59dd1
commit 65631dde4c
4 changed files with 278 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
templates/mail/pw_reset.html.twig
View file

@ -6,9 +6,9 @@
<h4>{% trans with {'%name%': user.fullName|escape } %}email.hi %name%{% endtrans %},</h4>
{% trans %}email.pw_reset.message{% endtrans %}
<br>
<button class="large expand" href="{{ url('pw_reset_new_pw', {user: user.name, token: token}) }}">{% trans %}email.pw_reset.button{% endtrans %}</button>
<button class="large expand" href="{{ reset_url }}">{% trans %}email.pw_reset.button{% endtrans %}</button>
<br>
{% trans with {'%url%': url('pw_reset_new_pw') } %}email.pw_reset.fallback{% endtrans %}:
{% trans with {'%url%': reset_url_fallback } %}email.pw_reset.fallback{% endtrans %}:
<callout class="secondary">
<row>
<columns>