-
-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Description
When requesting a password reset, the email content is out of date
Current email
Hi USERNAME,
A password reset request was received from A.B.C.D. To confirm this password change so you can login with your new credentials, visit the following link:
https://demo.matomo.org/index.php?module=Login&action=confirmResetPassword&login=root&resetToken=xxxxxxx
Attention: Changing the password will also change your token_auth. You can look up your new token_auth on your settings page.
If you are using your API token_auth in any external applications or for archiving, make sure to update the token_auth as requests to the API will fail otherwise.
Note: this link will expire in 24 hours.
And thank you for using Matomo!
Changes to make:
-
Remove the 2 sentences saying the token_auth changes when you reset password. Since a few versions ago, we have de-coupled password and token_auth and now changing password does not change token anymore.
-
Do not make the link clickable. it is too easy to fall in a trap of an attacker requesting a password reset, and one opening the email and clicking on the link by mistake / habit of trusting all emails from Matomo. Requesting a password reset is one of the most critical things and it's important to make sure people understand what they're doing (and can't be easily tricked).
-
Update the text from "visit the following link" to "please copy and paste the following link in your browser:"