{"action":"created","issue":{"url":"https://api.github.com/repos/ato/clojars-web/issues/348","labels_url":"https://api.github.com/repos/ato/clojars-web/issues/348/labels{/name}","comments_url":"https://api.github.com/repos/ato/clojars-web/issues/348/comments","events_url":"https://api.github.com/repos/ato/clojars-web/issues/348/events","html_url":"https://github.com/ato/clojars-web/issues/348","id":86395650,"number":348,"title":"Password reminder exception, email address exposed","user":{"login":"lucag","id":740211,"avatar_url":"https://avatars.githubusercontent.com/u/740211?v=3","gravatar_id":"","url":"https://api.github.com/users/lucag","html_url":"https://github.com/lucag","followers_url":"https://api.github.com/users/lucag/followers","following_url":"https://api.github.com/users/lucag/following{/other_user}","gists_url":"https://api.github.com/users/lucag/gists{/gist_id}","starred_url":"https://api.github.com/users/lucag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucag/subscriptions","organizations_url":"https://api.github.com/users/lucag/orgs","repos_url":"https://api.github.com/users/lucag/repos","events_url":"https://api.github.com/users/lucag/events{/privacy}","received_events_url":"https://api.github.com/users/lucag/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-09T01:14:44Z","updated_at":"2015-06-15T14:03:31Z","closed_at":null,"body":"Trying to get a password reminder for an account with invalid email fails with an exception. Moreover, the invalid **email address** is **exposed** in the exception traceback. This was from https://clojars.org/forgot-password:\r\n\r\n```\r\norg.apache.commons.mail.EmailException: Sending the email to the following server failed : localhost:25\r\n                    Email.java:1242 org.apache.commons.mail.Email.sendMimeMessage\r\n                    Email.java:1267 org.apache.commons.mail.Email.send\r\n                   (Unknown Source) sun.reflect.NativeMethodAccessorImpl.invoke0\r\n   NativeMethodAccessorImpl.java:57 sun.reflect.NativeMethodAccessorImpl.invoke\r\nDelegatingMethodAccessorImpl.java:43 sun.reflect.DelegatingMethodAccessorImpl.invoke\r\n                    Method.java:622 java.lang.reflect.Method.invoke\r\n                  Reflector.java:93 clojure.lang.Reflector.invokeMatchingMethod\r\n                 Reflector.java:313 clojure.lang.Reflector.invokeNoArgInstanceMember\r\n                       user.clj:154 clojars.web.user/send-out\r\n                       user.clj:170 clojars.web.user/send-mail\r\n                       user.clj:179 clojars.web.user/forgot-password\r\n                        user.clj:26 clojars.routes.user/fn\r\n                       core.clj:113 compojure.core/make-route[fn]\r\n                       core.clj:103 compojure.core/wrap-route-middleware[fn]\r\n                        core.clj:41 compojure.core/if-route[fn]\r\n                        core.clj:27 compojure.core/if-method[fn]\r\n                       core.clj:127 compojure.core/routing[fn]\r\n                      core.clj:2515 clojure.core/some\r\n                       core.clj:127 compojure.core/routing\r\n                    RestFn.java:139 clojure.lang.RestFn.applyTo\r\n                       core.clj:626 clojure.core/apply\r\n                       core.clj:132 compojure.core/routes[fn]\r\n                       core.clj:127 compojure.core/routing[fn]\r\n                      core.clj:2515 clojure.core/some\r\n                       core.clj:127 compojure.core/routing\r\n                    RestFn.java:139 clojure.lang.RestFn.applyTo\r\n                       core.clj:626 clojure.core/apply\r\n                       core.clj:132 compojure.core/routes[fn]\r\n                     friend.clj:222 cemerick.friend/handler-request\r\n                     friend.clj:249 cemerick.friend/authenticate*\r\n                     friend.clj:260 cemerick.friend/authenticate[fn]\r\n                anti_forgery.clj:57 ring.middleware.anti-forgery/wrap-anti-forgery[fn]\r\n                  error_page.clj:23 clojars.web.error-page/wrap-exceptions[fn]\r\n                         web.clj:84 clojars.web/wrap-x-frame-options[fn]\r\n              keyword_params.clj:35 ring.middleware.keyword-params/wrap-keyword-params[fn]\r\n                      params.clj:64 ring.middleware.params/wrap-params[fn]\r\n           multipart_params.clj:118 ring.middleware.multipart-params/wrap-multipart-params[fn]\r\n                       flash.clj:35 ring.middleware.flash/wrap-flash[fn]\r\n                     session.clj:98 ring.middleware.session/wrap-session[fn]\r\n                         web.clj:97 clojars.web/wrap-secure-session[fn]\r\n                    resource.clj:26 ring.middleware.resource/wrap-resource[fn]\r\n                   file_info.clj:69 ring.middleware.file-info/wrap-file-info[fn]\r\n                       core.clj:127 compojure.core/routing[fn]\r\n                      core.clj:2515 clojure.core/some\r\n                       core.clj:127 compojure.core/routing\r\n                    RestFn.java:139 clojure.lang.RestFn.applyTo\r\n                       core.clj:626 clojure.core/apply\r\n                       core.clj:132 compojure.core/routes[fn]\r\n                       Var.java:379 clojure.lang.Var.invoke\r\n                       jetty.clj:18 ring.adapter.jetty/proxy-handler[fn]\r\n                   (Unknown Source) ring.adapter.jetty.proxy$org.eclipse.jetty.server.handler.AbstractHandler$ff19274a.handle\r\n            HandlerWrapper.java:111 org.eclipse.jetty.server.handler.HandlerWrapper.handle\r\n                    Server.java:349 org.eclipse.jetty.server.Server.handle\r\n    AbstractHttpConnection.java:452 org.eclipse.jetty.server.AbstractHttpConnection.handleRequest\r\n    AbstractHttpConnection.java:894 org.eclipse.jetty.server.AbstractHttpConnection.content\r\n    AbstractHttpConnection.java:948 org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.content\r\n                HttpParser.java:857 org.eclipse.jetty.http.HttpParser.parseNext\r\n                HttpParser.java:235 org.eclipse.jetty.http.HttpParser.parseAvailable\r\n        AsyncHttpConnection.java:76 org.eclipse.jetty.server.AsyncHttpConnection.handle\r\n     SelectChannelEndPoint.java:609 org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle\r\n      SelectChannelEndPoint.java:45 org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run\r\n          QueuedThreadPool.java:599 org.eclipse.jetty.util.thread.QueuedThreadPool.runJob\r\n          QueuedThreadPool.java:534 org.eclipse.jetty.util.thread.QueuedThreadPool$3.run\r\n                    Thread.java:701 java.lang.Thread.run\r\nCaused by: javax.mail.SendFailedException: Invalid Addresses\r\n            SMTPTransport.java:1294 com.sun.mail.smtp.SMTPTransport.rcptTo\r\n             SMTPTransport.java:635 com.sun.mail.smtp.SMTPTransport.sendMessage\r\n                 Transport.java:189 javax.mail.Transport.send0\r\n                 Transport.java:118 javax.mail.Transport.send\r\n                    Email.java:1232 org.apache.commons.mail.Email.sendMimeMessage\r\nCaused by: com.sun.mail.smtp.SMTPAddressFailedException: 450 4.1.2 <lucag@icsi.berkeley.ed>: Recipient address rejected: Domain not found\r\n``` "},"comment":{"url":"https://api.github.com/repos/ato/clojars-web/issues/comments/112081175","html_url":"https://github.com/ato/clojars-web/issues/348#issuecomment-112081175","issue_url":"https://api.github.com/repos/ato/clojars-web/issues/348","id":112081175,"user":{"login":"tobias","id":2631,"avatar_url":"https://avatars.githubusercontent.com/u/2631?v=3","gravatar_id":"","url":"https://api.github.com/users/tobias","html_url":"https://github.com/tobias","followers_url":"https://api.github.com/users/tobias/followers","following_url":"https://api.github.com/users/tobias/following{/other_user}","gists_url":"https://api.github.com/users/tobias/gists{/gist_id}","starred_url":"https://api.github.com/users/tobias/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tobias/subscriptions","organizations_url":"https://api.github.com/users/tobias/orgs","repos_url":"https://api.github.com/users/tobias/repos","events_url":"https://api.github.com/users/tobias/events{/privacy}","received_events_url":"https://api.github.com/users/tobias/received_events","type":"User","site_admin":false},"created_at":"2015-06-15T14:03:31Z","updated_at":"2015-06-15T14:03:31Z","body":"@lucag - I fixed your email address. Let me know if you have any other issues."}}