diff --git a/src/routes/cloudron.js b/src/routes/cloudron.js index ead9f459d..f85a55752 100644 --- a/src/routes/cloudron.js +++ b/src/routes/cloudron.js @@ -87,7 +87,7 @@ async function passwordResetRequest(req, res, next) { if (!req.body.identifier || typeof req.body.identifier !== 'string') return next(new HttpError(401, 'A identifier must be non-empty string')); const [error] = await safe(users.sendPasswordResetByIdentifier(req.body.identifier, AuditSource.fromRequest(req))); - if (error && error.reason !== BoxError.NOT_FOUND) return next(BoxError.toHttpError(error)); + if (error && !(error.reason === BoxError.NOT_FOUND || error.reason === BoxError.CONFLICT)) return next(BoxError.toHttpError(error)); next(new HttpSuccess(202, {})); } diff --git a/src/users.js b/src/users.js index e50da6737..9db92cf05 100644 --- a/src/users.js +++ b/src/users.js @@ -661,7 +661,7 @@ async function sendPasswordResetByIdentifier(identifier, auditSource) { // security measure to prevent a mail manager or admin resetting the superadmin's password const mailDomains = await mail.listDomains(); - if (mailDomains.some(d => d.enabled && email.endsWith(`@${d.domain}`))) throw new BoxError(BoxError.CONFLICT, 'Password reset email cannot be sent to email addresses hosted on Cloudron'); + if (mailDomains.some(d => d.enabled && email.endsWith(`@${d.domain}`))) throw new BoxError(BoxError.CONFLICT, 'Password reset email cannot be sent to email addresses hosted on the same Cloudron'); const resetLink = await getPasswordResetLink(user, auditSource); await mailer.passwordReset(user, email, resetLink); @@ -677,7 +677,7 @@ async function sendPasswordResetEmail(user, email, auditSource) { // security measure to prevent a mail manager or admin resetting the superadmin's password const mailDomains = await mail.listDomains(); - if (mailDomains.some(d => d.enabled && email.endsWith(`@${d.domain}`))) throw new BoxError(BoxError.CONFLICT, 'Password reset email cannot be sent to email addresses hosted on Cloudron'); + if (mailDomains.some(d => d.enabled && email.endsWith(`@${d.domain}`))) throw new BoxError(BoxError.CONFLICT, 'Password reset email cannot be sent to email addresses hosted on the same Cloudron'); const resetLink = await getPasswordResetLink(user, auditSource); await mailer.passwordReset(user, email, resetLink);