From aadb0b15f2bbdc5272bb7b6c5dd2c0230fab2c80 Mon Sep 17 00:00:00 2001
From: Paulo Telles <paulomarquestelles@gmail.com>
Date: Thu, 4 May 2023 14:39:04 +0200
Subject: [PATCH] change response text to avoid reveal user's data (#161)

* change response text to avoid reveal user's data

* include log into forgot password

---------

Co-authored-by: p.souza <p.souza@cognigy.com>
---
 lib/routes/api/forgot-password.js | 9 ++++++---
 lib/routes/api/users.js           | 4 ++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/routes/api/forgot-password.js b/lib/routes/api/forgot-password.js
index d9f9bb6..8f1f92b 100644
--- a/lib/routes/api/forgot-password.js
+++ b/lib/routes/api/forgot-password.js
@@ -55,13 +55,16 @@ router.post('/', async(req, res) => {
 
     const [r] = await promisePool.query({sql, nestTables: true}, email);
     if (0 === r.length) {
-      return res.status(400).json({error: 'email does not exist'});
+      logger.info('user not found');
+      return res.status(400).json({error: 'failed to reset your password'});
     }
     obj = r[0];
     if (!obj.user.is_active) {
-      return res.status(400).json({error: 'you may not reset the password of an inactive user'});
+      logger.info(obj.user.name, 'user is inactive');
+      return res.status(400).json({error: 'failed to reset your password'});
     } else if (obj.acc.account_sid !== null && !obj.acc.is_active) {
-      return res.status(400).json({error: 'you may not reset the password of an inactive account'});
+      logger.info(obj.acc.account_sid, 'account is inactive');
+      return res.status(400).json({error: 'failed to reset your password'});
     }
     res.sendStatus(204);
   } catch (err) {
diff --git a/lib/routes/api/users.js b/lib/routes/api/users.js
index 9326283..45a655b 100644
--- a/lib/routes/api/users.js
+++ b/lib/routes/api/users.js
@@ -453,12 +453,12 @@ router.post('/', async(req, res) => {
 
     if (name) {
       logger.debug({payload}, 'user with this username already exists');
-      return res.status(422).json({msg: 'user with this username already exists'});
+      return res.status(422).json({msg: 'invalid username or email'});
     }
 
     if (email) {
       logger.debug({payload}, 'user with this email already exists');
-      return res.status(422).json({msg: 'user with this email already exists'});
+      return res.status(422).json({msg: 'invalid username or email'});
     }
 
     if (req.user.hasAdminAuth) {