Prevent user enumeration on password reset

TalysonSoares · TalysonSoares · commit 8e4015907c02 · 2025-10-20T15:13:10.000-03:00
diff --git a/src/Controller/Web/AccountEventWebController.php b/src/Controller/Web/AccountEventWebController.php
@@ -73,7 +73,6 @@ public function forgotPassword(
         try {
             $this->accountEventService->sendResetPasswordEmail($email);
         } catch (UserResourceNotFoundException) {
-            return $this->redirectToRoute('web_home_homepage');
         }
 
         $this->addFlash('success', $this->translator->trans('view.authentication.forgot.link_sent_to_email'));

Original file line number	Diff line number	Diff line change
`@@ -73,7 +73,6 @@ public function forgotPassword(`
`73`	`73`	`try {`
`74`	`74`	`$this->accountEventService->sendResetPasswordEmail($email);`
`75`	`75`	`} catch (UserResourceNotFoundException) {`
`76`		`- return $this->redirectToRoute('web_home_homepage');`
`77`	`76`	`}`
`78`	`77`
`79`	`78`	`$this->addFlash('success', $this->translator->trans('view.authentication.forgot.link_sent_to_email'));`