RSS Feed/News Account security lock message leaks email

[ENXF NET]

When a login attempt is made for an account that has a security lock Must reset password phrase your_account_is_currently_security_locked_and_awaiting_password_reset is shown to the visitor:

Code:

Your account is currently security locked and awaiting a password reset. A request was sent to {email}<br />
<a href="{resendLink}" data-xf-click="overlay">Resend request</a>

This phrase contains the accout {email} which is shown to the visitor.

It is somewhat likely that an...

Read more

Continue reading...