From ed703146863f896df76c98fad7127c6748c0ef9b Mon Sep 17 00:00:00 2001
From: Simba Chawanda <simba.chawanda@gmail.com>
Date: Thu, 25 Apr 2024 09:27:37 +0200
Subject: [PATCH] fix(security): Prevent email enumeration

---
 packages/backend/src/routers/send-pass-recovery-email.js | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/packages/backend/src/routers/send-pass-recovery-email.js b/packages/backend/src/routers/send-pass-recovery-email.js
index f1fa8dd5d..33f43df6c 100644
--- a/packages/backend/src/routers/send-pass-recovery-email.js
+++ b/packages/backend/src/routers/send-pass-recovery-email.js
@@ -114,10 +114,7 @@ router.post('/send-pass-recovery-email', express.json(), body_parser_error_handl
         });
 
         // Send response
-        if(req.body.username)
-            return res.send({message: `Password recovery sent to the email associated with <strong>${user.username}</strong>. Please check your email for instructions on how to reset your password.`});
-        else
-            return res.send({message: `Password recovery email sent to <strong>${user.email}</strong>. Please check your email for instructions on how to reset your password.`});
+	return res.send({message: `If the email address exists in our database. A recovery email will be sent to <strong>${user.email}</strong>`});
 
     }catch(e){
         console.log(e)
@@ -126,4 +123,4 @@ router.post('/send-pass-recovery-email', express.json(), body_parser_error_handl
 
 })
 
-module.exports = router
\ No newline at end of file
+module.exports = router