Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Commit

Permalink
Don't check whether a 3pid is allowed to register during password reset
Browse files Browse the repository at this point in the history
This check was preventing people from resetting their passwords unless they
already had a pending invite to that email address, which makes no sense.
  • Loading branch information
anoadragon453 committed Sep 28, 2020
1 parent 1fa060e commit 5858093
Showing 1 changed file with 0 additions and 7 deletions.
7 changes: 0 additions & 7 deletions synapse/rest/client/v2_alpha/account.py
Original file line number Diff line number Diff line change
Expand Up @@ -91,13 +91,6 @@ async def on_POST(self, request):
send_attempt = body["send_attempt"]
next_link = body.get("next_link") # Optional param

if not await check_3pid_allowed(self.hs, "email", email):
raise SynapseError(
403,
"Your email domain is not authorized on this server",
Codes.THREEPID_DENIED,
)

# The email will be sent to the stored address.
# This avoids a potential account hijack by requesting a password reset to
# an email address which is controlled by the attacker but which, after
Expand Down

0 comments on commit 5858093

Please sign in to comment.