Password reset json endpoint reveals whether an email or username is in use

This issue is being reviewed by the kind folks in Slack, #needs-review-queue-initiative. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge request → as a guide.

Ran the tests locally without to the fix to make sure they failed. The response was really long but did fail

Caused by
 ErrorException: Method "IteratorAggregate::getIterator()" might add "\Traversable" as a native return type declaration in the future. Do the same in implementation "Drupal\Core\Entity\ContentEntityBase" now to avoid errors or add an explicit @return annotation to suppress this message.

shouldn't we also test whether the errors are logged?

If that's something you want to test you could probably query the database.

Will move to NW for that but if it's actually not needed please send back.

Everything else looks good.

s.messaris → made their first commit to this issue’s fork.

Rerolled for 11.x and added the missing test scenarios

Seems the reroll caused test fialures.

Wasn't the reroll, was the new test I added, I fixed it. Got an unrelated fail though, seems random, trying again.

Test bot seems to like this after all, back to review :)

Change looks good but I imagine there may be some pushback on

$logged = Database::getConnection()->select('watchdog')

But not sure if there's a trait that can be used but will see

Good work everyone!

@smustgrave I found it used like that 10 times across 4 files, not including the new addition, that's why I did it this way.

core/modules/comment/tests/src/Kernel/CommentIntegrationTest.php
core/modules/dblog/tests/src/Functional/DbLogTest.php
core/modules/dblog/tests/src/Kernel/DbLogTest.php
core/modules/system/tests/src/Functional/Form/StorageTest.php

Have no issue with it. Just have seen that get kicked back before.

Hiding patches and updating issue credits

Committed 98618df and pushed to 11.x. Thanks!

Backported to 10.1.x as this is an important security fix.

Added 📌 Move \Drupal\Tests\system\Functional\Module\ModuleTestBase::assertLogMessage to a trait Needs work as a followup

Automatically closed - issue fixed for 2 weeks with no activity.