From ed703146863f896df76c98fad7127c6748c0ef9b Mon Sep 17 00:00:00 2001
From: Simba Chawanda <simba.chawanda@gmail.com>
Date: Thu, 25 Apr 2024 09:27:37 +0200
Subject: [PATCH 1/3] fix(security): Prevent email enumeration

---
 packages/backend/src/routers/send-pass-recovery-email.js | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/packages/backend/src/routers/send-pass-recovery-email.js b/packages/backend/src/routers/send-pass-recovery-email.js
index f1fa8dd5d..33f43df6c 100644
--- a/packages/backend/src/routers/send-pass-recovery-email.js
+++ b/packages/backend/src/routers/send-pass-recovery-email.js
@@ -114,10 +114,7 @@ router.post('/send-pass-recovery-email', express.json(), body_parser_error_handl
         });
 
         // Send response
-        if(req.body.username)
-            return res.send({message: `Password recovery sent to the email associated with <strong>${user.username}</strong>. Please check your email for instructions on how to reset your password.`});
-        else
-            return res.send({message: `Password recovery email sent to <strong>${user.email}</strong>. Please check your email for instructions on how to reset your password.`});
+	return res.send({message: `If the email address exists in our database. A recovery email will be sent to <strong>${user.email}</strong>`});
 
     }catch(e){
         console.log(e)
@@ -126,4 +123,4 @@ router.post('/send-pass-recovery-email', express.json(), body_parser_error_handl
 
 })
 
-module.exports = router
\ No newline at end of file
+module.exports = router

From e2dcc813ec8154b2101a9afa265a28314b796ba7 Mon Sep 17 00:00:00 2001
From: Nariman Jelveh <n.jelveh@gmail.com>
Date: Thu, 25 Apr 2024 13:18:28 -0700
Subject: [PATCH 2/3] Allow the `<p>` tag in `UIAlert` body

---
 src/UI/UIAlert.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/UI/UIAlert.js b/src/UI/UIAlert.js
index 7016e138d..c5763ea0b 100644
--- a/src/UI/UIAlert.js
+++ b/src/UI/UIAlert.js
@@ -52,6 +52,10 @@ function UIAlert(options){
         santized_message = santized_message.replace(/&lt;strong&gt;/g, '<strong>');
         santized_message = santized_message.replace(/&lt;\/strong&gt;/g, '</strong>');
 
+        // replace sanitized <p> with <p>
+        santized_message = santized_message.replace(/&lt;p&gt;/g, '<p>');
+        santized_message = santized_message.replace(/&lt;\/p&gt;/g, '</p>');
+
         let h = '';
         // icon
         h += `<img class="window-alert-icon" src="${html_encode(options.body_icon)}">`;

From 3cce0e88df10622748e7f277c8922b08d29f8a10 Mon Sep 17 00:00:00 2001
From: Nariman Jelveh <n.jelveh@gmail.com>
Date: Thu, 25 Apr 2024 13:18:37 -0700
Subject: [PATCH 3/3] Revert "Allow the `<p>` tag in `UIAlert` body"

This reverts commit e2dcc813ec8154b2101a9afa265a28314b796ba7.
---
 src/UI/UIAlert.js | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/src/UI/UIAlert.js b/src/UI/UIAlert.js
index c5763ea0b..7016e138d 100644
--- a/src/UI/UIAlert.js
+++ b/src/UI/UIAlert.js
@@ -52,10 +52,6 @@ function UIAlert(options){
         santized_message = santized_message.replace(/&lt;strong&gt;/g, '<strong>');
         santized_message = santized_message.replace(/&lt;\/strong&gt;/g, '</strong>');
 
-        // replace sanitized <p> with <p>
-        santized_message = santized_message.replace(/&lt;p&gt;/g, '<p>');
-        santized_message = santized_message.replace(/&lt;\/p&gt;/g, '</p>');
-
         let h = '';
         // icon
         h += `<img class="window-alert-icon" src="${html_encode(options.body_icon)}">`;