User email disclosure in /user/password

Been thinking about this for a bit. I don't think this should be an opt-in feature like the patch in #2 is doing. I have checked a few other applications and CMS's systems (including Wordpress) and none of them (which I tested) pre-fill the username/email field if there is one.

This might break a few tests so those will need to be fixed as well.

Luckily only a failures :)

If I had to vote I would say the opt-in feature makes the most sense.

Though since it's only passing what was inputted in the username field, and not really validating the username, think the default should be to not include the username.

I'm still more fan of removal. Having a checkbox in Core that makes your site less secure seems a tad weird (it would also need a disclaimer then since it has security implications). We would also need to do config changes, provide an upgrade hook etc for this which in my eyes looks a bit overkill as well. It's "just" the password forgot redirect query parameter :-) it's not like we are really breaking or changing functionality. Besides pre-filling that form of course, but most people with browser autocomplete won't even notice this I think.

Since I’ve never noticed this feature don’t see any issue removing. I don’t think it would be much of a lose

All green removing the feature.

Hiding patches, updated credits

Committed 4b0e870 and pushed to 11.x. Thanks!

Because of the minor behaviour change here, decided not to backport this.

Created a change record for the new behaviour

larowlan → closed merge request !3989

Automatically closed - issue fixed for 2 weeks with no activity.