4 ms·

This doesn't look like the actual fix but rather a follow-up refactor. I believe the fix is here: https://gitlab.com/gitlab-org/gitlab/-/commit/abe79e4ec437988c

This doesn't look like the actual fix but rather a follow-up refactor. I believe the fix is here: https://gitlab.com/gitlab-org/gitlab/-/commit/abe79e4ec437988cf16534a9dbba81b98a2e7f18 https://gitlab.com/gitlab-org/gitlab/-/commit/abe79e4ec43798... - recoverable.send_reset_password_instructions(to: email) if recoverable&.persisted? + recoverable.send_reset_password_instructions if recoverable&.persisted?

alexpls 3y ago
Oh yeah, good pickup thanks!
progval 3y ago
and making send_reset_password_instructions get the email addresses itself from the "recoverable" object.
1oooqooq 3y ago
on GitHub, the fix would be adding a regex to ensure there was no list on the user supplied email.