Implied consent for password reset

[ashleybroughton]

Should we remove this check for consent? https://github.com/csharpfritz/CoreWiki/blob/dev/CoreWiki.Notifications/NotificationService.cs#L89-L92

It not only doesn't stop processing after the consent check fails, but if a user requested a password reset, isn't consent implied?

If it's the case of a malicious user requesting password resets, the end user probably wants to know about that.

Perhaps we should implement rate limiting for reset requests.

[erwindevreugd]

The log string is definitely wrong and the func parameter name could be better. The idea was that you would pass in a function that would evaluate whether or not the email could be sent. For generic emails this would check the cannotify/emailvalidated values. For any essential emails (ie password reset) the idea was that this would always return true, but your suggestion about rate limiting would make sense here. Since this class needed to be uncoupled from the CoreWiki project we cannot directly access the database for this.