cms
cms copied to clipboard
Prevent email enumeration on public registration
Description
On a public registration form, email addresses can be leaked via enumeration when an existing email is entered. When this happens, this PR will respond as though the user successfully registered – but instead of saving the user and sending an activation email, it will send an email verification to the existing user.
Questions
Is sending an activation email enough, or do we need a dedicated system message for this?