{"action":"created","issue":{"url":"https://api.github.com/repos/FriendsOfSymfony/FOSUserBundle/issues/952","repository_url":"https://api.github.com/repos/FriendsOfSymfony/FOSUserBundle","labels_url":"https://api.github.com/repos/FriendsOfSymfony/FOSUserBundle/issues/952/labels{/name}","comments_url":"https://api.github.com/repos/FriendsOfSymfony/FOSUserBundle/issues/952/comments","events_url":"https://api.github.com/repos/FriendsOfSymfony/FOSUserBundle/issues/952/events","html_url":"https://github.com/FriendsOfSymfony/FOSUserBundle/issues/952","id":9982343,"number":952,"title":"Resetting password with BOTH username and email","user":{"login":"runcom","id":849915,"avatar_url":"https://avatars.githubusercontent.com/u/849915?v=3","gravatar_id":"","url":"https://api.github.com/users/runcom","html_url":"https://github.com/runcom","followers_url":"https://api.github.com/users/runcom/followers","following_url":"https://api.github.com/users/runcom/following{/other_user}","gists_url":"https://api.github.com/users/runcom/gists{/gist_id}","starred_url":"https://api.github.com/users/runcom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/runcom/subscriptions","organizations_url":"https://api.github.com/users/runcom/orgs","repos_url":"https://api.github.com/users/runcom/repos","events_url":"https://api.github.com/users/runcom/events{/privacy}","received_events_url":"https://api.github.com/users/runcom/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/FriendsOfSymfony/FOSUserBundle/milestones/4","html_url":"https://github.com/FriendsOfSymfony/FOSUserBundle/milestones/2.0","labels_url":"https://api.github.com/repos/FriendsOfSymfony/FOSUserBundle/milestones/4/labels","id":124377,"number":4,"title":"2.0","description":"","creator":{"login":"stof","id":439401,"avatar_url":"https://avatars.githubusercontent.com/u/439401?v=3","gravatar_id":"","url":"https://api.github.com/users/stof","html_url":"https://github.com/stof","followers_url":"https://api.github.com/users/stof/followers","following_url":"https://api.github.com/users/stof/following{/other_user}","gists_url":"https://api.github.com/users/stof/gists{/gist_id}","starred_url":"https://api.github.com/users/stof/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stof/subscriptions","organizations_url":"https://api.github.com/users/stof/orgs","repos_url":"https://api.github.com/users/stof/repos","events_url":"https://api.github.com/users/stof/events{/privacy}","received_events_url":"https://api.github.com/users/stof/received_events","type":"User","site_admin":false},"open_issues":25,"closed_issues":23,"state":"open","created_at":"2012-05-26T15:26:08Z","updated_at":"2016-03-01T12:23:51Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2013-01-15T15:32:45Z","updated_at":"2016-04-14T19:11:47Z","closed_at":null,"body":"The reset password process should take the username and the email linked to it, otherwise everybody can play the \"is registered game\" easly and begin the reset process. It would be a bit more complex to enter the right email for a given username.\r\nAnd of course any error doesn't have to leak information about the username (like \"wrong email for this username\" or \"username not found\"). Just \"Invalid email\"\r\n\r\nOr at least reset password should only begin if there's a valid email address (less secure than the process above but safer than \"username or email\")"},"comment":{"url":"https://api.github.com/repos/FriendsOfSymfony/FOSUserBundle/issues/comments/210104858","html_url":"https://github.com/FriendsOfSymfony/FOSUserBundle/issues/952#issuecomment-210104858","issue_url":"https://api.github.com/repos/FriendsOfSymfony/FOSUserBundle/issues/952","id":210104858,"user":{"login":"patrickmatsumura","id":927192,"avatar_url":"https://avatars.githubusercontent.com/u/927192?v=3","gravatar_id":"","url":"https://api.github.com/users/patrickmatsumura","html_url":"https://github.com/patrickmatsumura","followers_url":"https://api.github.com/users/patrickmatsumura/followers","following_url":"https://api.github.com/users/patrickmatsumura/following{/other_user}","gists_url":"https://api.github.com/users/patrickmatsumura/gists{/gist_id}","starred_url":"https://api.github.com/users/patrickmatsumura/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/patrickmatsumura/subscriptions","organizations_url":"https://api.github.com/users/patrickmatsumura/orgs","repos_url":"https://api.github.com/users/patrickmatsumura/repos","events_url":"https://api.github.com/users/patrickmatsumura/events{/privacy}","received_events_url":"https://api.github.com/users/patrickmatsumura/received_events","type":"User","site_admin":false},"created_at":"2016-04-14T19:11:47Z","updated_at":"2016-04-14T19:11:47Z","body":"> I concur on the issue of obfuscation: never reveal if the username or email address exists or not.\r\n\r\nMe too."}}