Skip to content

When requesting a password reset, the email content is out of date #13520

@mattab

Description

@mattab

When requesting a password reset, the email content is out of date

Current email

Hi USERNAME,

A password reset request was received from A.B.C.D. To confirm this password change so you can login with your new credentials, visit the following link:

https://demo.matomo.org/index.php?module=Login&action=confirmResetPassword&login=root&resetToken=xxxxxxx

Attention: Changing the password will also change your token_auth. You can look up your new token_auth on your settings page.

If you are using your API token_auth in any external applications or for archiving, make sure to update the token_auth as requests to the API will fail otherwise.

Note: this link will expire in 24 hours.

And thank you for using Matomo!

Changes to make:

  • Remove the 2 sentences saying the token_auth changes when you reset password. Since a few versions ago, we have de-coupled password and token_auth and now changing password does not change token anymore.

  • Do not make the link clickable. it is too easy to fall in a trap of an attacker requesting a password reset, and one opening the email and clicking on the link by mistake / habit of trusting all emails from Matomo. Requesting a password reset is one of the most critical things and it's important to make sure people understand what they're doing (and can't be easily tricked).

  • Update the text from "visit the following link" to "please copy and paste the following link in your browser:"

Metadata

Metadata

Assignees

Labels

c: SecurityFor issues that make Matomo more secure. Please report issues through HackerOne and not in Github.

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions