Skip to content

Send email to administrator when an unauthorized user requests a password reset#5567

Merged
bdukes merged 1 commit intodnnsoftware:developfrom
johnhenley:issues/5245
Apr 25, 2023
Merged

Send email to administrator when an unauthorized user requests a password reset#5567
bdukes merged 1 commit intodnnsoftware:developfrom
johnhenley:issues/5245

Conversation

@johnhenley
Copy link
Copy Markdown
Contributor

@johnhenley johnhenley commented Mar 9, 2023

Closes #5245

Summary

Email administrator when an unapproved user requests a password reset. Then the administrator can verify that it is a valid request, and if so, authorize the user and send a new password reset.

@johnhenley
Copy link
Copy Markdown
Contributor Author

johnhenley commented Mar 9, 2023 •
edited
Loading

  • I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
    @microsoft-github-policy-service agree

@bdukes
Copy link
Copy Markdown
Contributor

bdukes commented Mar 9, 2023

@johnhenley you need to write @microsoft-github-policy-service agree to tell the bot you agree with that statement

mitchelsellers
mitchelsellers reviewed Mar 9, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@mitchelsellers mitchelsellers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand the intent here, but I'm slightly concerned that this could allow someone to abuse the system by constantly requesting a forgotten password and overwhelming administrators otherwise?

@dnnsoftware/approvers thoughts?

@bdukes
Copy link
Copy Markdown
Contributor

bdukes commented Mar 9, 2023

I think the value is greater than the potential for abuse.

@johnhenley
Copy link
Copy Markdown
Contributor Author

johnhenley commented Mar 11, 2023

I understand the intent here, but I'm slightly concerned that this could allow someone to abuse the system by constantly requesting a forgotten password and overwhelming administrators otherwise?

@dnnsoftware/approvers thoughts?

@mitchelsellers understand and agree with your concerns about potential for abuse. What are your thoughts on adding a PasswordResetOutstandingRequestCount (or just a flag that a request is outstanding) to UserInfo and only sending to administrator on first request?

@bdukes bdukes added this to the 9.11.3 milestone Apr 25, 2023
@bdukes bdukes merged commit edabf5d into dnnsoftware:develop Apr 25, 2023
@bdukes
Copy link
Copy Markdown
Contributor

bdukes commented Apr 25, 2023

Thanks!

@johnhenley johnhenley deleted the issues/5245 branch June 23, 2023 12:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bdukes bdukes bdukes approved these changes

@mitchelsellers mitchelsellers mitchelsellers approved these changes

Assignees

No one assigned

Labels

Type: Enhancement

Projects

None yet

Milestone

9.12.0

Development

Successfully merging this pull request may close these issues.

Send email notification to administrator when an unauthorized user requests a password reset

3 participants

@johnhenley @bdukes @mitchelsellers