kobotoolbox / kpi / 18900913884

81%

master: 76%

push

github

fix(auth): stop sending password reset emails to unknown accounts DEV-1108 (#6410)

### 📣 Summary
Prevent password reset emails from being sent to unregistered email
addresses while keeping the same non-revealing message on the reset
page.


### 📖 Description
Previously, Kobo would send a password reset email even when the entered
email address was not associated with any existing account.
This behavior, inherited from django-allauth defaults, could lead to
unsolicited emails being sent to arbitrary addresses.

This PR updates the configuration to:
- Set `ACCOUNT_EMAIL_UNKNOWN_ACCOUNTS = False`, ensuring no email is
sent if the address doesn’t match any account.
- Preserve the existing UI message to avoid exposing valid accounts and
maintain account-enumeration protection.

7071 of 11112 branches covered (63.63%)

1 of 1 new or added line in 1 file covered. (100.0%)

27344 of 33614 relevant lines covered (81.35%)

1.6 hits per line