Jeremy Lin 88bea44dd8 Prevent user enumeration via password hints ...

When `show_password_hint` is enabled but mail is not configured, the previous
implementation returned a differentiable response for non-existent email
addresses.

Even if mail is enabled, there is a timing side channel since mail is sent
synchronously. Add a randomized sleep to mitigate this somewhat.

2021-07-10 01:21:27 -07:00

..

core

Prevent user enumeration via password hints

2021-07-10 01:21:27 -07:00

admin.rs

Multiple Admin Interface fixes and some others.

2021-06-19 19:22:19 +02:00

icons.rs

Fix clippy lints

2021-06-19 22:02:03 +02:00

identity.rs

Fix clippy lints

2021-06-19 22:02:03 +02:00

mod.rs

Fix clippy lints

2021-06-19 22:02:03 +02:00

notifications.rs

Fix clippy lints

2021-06-19 22:02:03 +02:00

web.rs

Add token with short expiration time to send url

2021-06-25 20:53:26 +02:00