False Positive Response on Forgotten Password Page

[jerrygarciuh]

Hello,

No matter what garbage email I make up the Forgotten Password routine always replies with the SUCCESS_PASSWORD_SENT message.

Additionally a search of the entire install's code for the TEXT_NO_EMAIL_ADDRESS_FOUND constant comes up empty except for the define() call in includes/languages/english/password_forgotten.php...

define('TEXT_NO_EMAIL_ADDRESS_FOUND', 'Error: The Email Address was not found in our records; please try again.');
define('SUCCESS_PASSWORD_SENT', 'A new password has been sent to your email address.');

In header_php.php I see

if ($check_customer->RecordCount() > 0) {
...
} else {
$zco_notifier->notify('NOTIFY_PASSWORD_FORGOTTEN_NOT_FOUND', $email_address);
}

$messageStack->add_session('login', SUCCESS_PASSWORD_SENT, 'success');

Since the success message is outside that conditional maybe that is why we always see the success message?

Additionally in my whole install I cannot find any other reference to NOTIFY_PASSWORD_FORGOTTEN_NOT_FOUND.

Is this a bug? How do I get notification of a bad email address delivered to screen here?

TIA

David

[DrByte]

Is this a bug? How do I get notification of a bad email address delivered to screen here?

No, it's not a bug. It's intentional.

Think of it this way: if a hacker is trying to guess usernames to get into your store by submitting thousands of possibilities to that page, and the Password Forgotten tells them when they have a bad one, but does something different when they find a good one, then BAM, the hacker suddenly has 50% of the information they need to break into your store.

Industry standard security rules state that security-related forms should NEVER disclose any evidence of failure different from success.

If you dislike the word 'success' being on-screen, then simply reword the message to "If the email address you entered is found in our system, password reset instructions have been emailed to you."
In fact, I believe the current version of Zen Cart does exactly that.

[jerrygarciuh]

I wondered if that might be the case but the presence of TEXT_NO_EMAIL_ADDRESS_FOUND in the file muddied the water and suggested that the functionality existed to notify users of a lack of a match.

Thank you very much for the reply! I'll let my client know.

David