0

I'm trying to harden a Joomla website (v3.9.13).

One problem which has been picked up is that the "Forgot password" can be used by a malicious person to check whether an email address is valid or not.

If you put in a bad one, it tells you that it's invalid.

If you put in a good one, it tells you that an email has been sent.

This means you can tell whether the email is valid or not.

Also asked on https://forum.joomla.org/viewtopic.php?f=714&t=976191#p3587991

Improve this question
2
  • 1
    This is not a bad question, but I do agree with others that it was already asked. If for any reason this doesn't give you what you need, you may edit your question to separate it from the focus on the other page and your question may qualify for reopening. (But with any luck that other page will be just what you need.)
    – mickmackusa
    Dec 2, 2019 at 20:21
  • Thanks. I had searched for a previous answer, but my search terms hadn't found this one above.
    – Rachel
    Dec 3, 2019 at 9:35

0

Reset to default

Browse other questions tagged or ask your own question.