github-mirrors/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-05-18 03:10:24 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(server): replace email-in-use messages to prevent user-existence oracle

Browse Source 
Error messages on registration and profile-update that named whether an
email address was already taken allowed callers to enumerate registered
accounts. All three sites now return the same generic message regardless
of whether the address is in use.
This commit is contained in:
timonrieger
2026-04-29 22:53:44 +02:00
parent fa6ce8cc00
commit 32cc8ca0aa
5 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/test/medium/specs/services/user.service.spec.ts
+1 -1
View File
@@ -48,7 +48,7 @@ describe(UserService.name, () => {
ctx.getMock(EventRepository).emit.mockResolvedValue();
const user = mediumFactory.userInsert();
await expect(sut.createUser({ name: 'Test', email: user.email })).resolves.toMatchObject({ email: user.email });
await expect(sut.createUser({ name: 'Test', email: user.email })).rejects.toThrow('User exists');
await expect(sut.createUser({ name: 'Test', email: user.email })).rejects.toThrow('Email is not available');
});
it('should not return password', async () => {