From 3331788c5cf35c8591f92ebcdd958af2db6a4eec Mon Sep 17 00:00:00 2001
From: Nikolaj Geisle <70372949+Zeegaan@users.noreply.github.com>
Date: Mon, 11 Dec 2023 13:59:35 +0100
Subject: [PATCH] Merge pull request from GHSA-8qp8-9rpw-j46c

* Ensure that missing access rules do not break the site (#15081)

(cherry picked from commit 67771450797eb2c72449ddcabfc38d5ebf99c7f3)

* Added Exception handling and replicated error and info message

* Update auth.resource.js

Fixed the message

* Changed Delay introduction to early phase to avoid repeating code.

---------

Co-authored-by: Kenn Jacobsen <kja@umbraco.dk>
Co-authored-by: jey <jey@umbraco.dk>
Co-authored-by: Jey <cyaqublu@gmail.com>
---
 .../Persistence/Dtos/AccessDto.cs                 |  2 +-
 .../Controllers/AuthenticationController.cs       | 15 ++++++++++++---
 .../src/common/resources/auth.resource.js         |  4 ++--
 .../views/components/application/umb-login.html   |  2 +-
 4 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/src/Umbraco.Infrastructure/Persistence/Dtos/AccessDto.cs b/src/Umbraco.Infrastructure/Persistence/Dtos/AccessDto.cs
index 354083dfa8..0821232826 100644
--- a/src/Umbraco.Infrastructure/Persistence/Dtos/AccessDto.cs
+++ b/src/Umbraco.Infrastructure/Persistence/Dtos/AccessDto.cs
@@ -37,5 +37,5 @@ internal class AccessDto
 
     [ResultColumn]
     [Reference(ReferenceType.Many, ReferenceMemberName = "AccessId")]
-    public List<AccessRuleDto> Rules { get; set; } = null!;
+    public List<AccessRuleDto> Rules { get; set; } = new();
 }
diff --git a/src/Umbraco.Web.BackOffice/Controllers/AuthenticationController.cs b/src/Umbraco.Web.BackOffice/Controllers/AuthenticationController.cs
index beb8787c79..19cc4ae70f 100644
--- a/src/Umbraco.Web.BackOffice/Controllers/AuthenticationController.cs
+++ b/src/Umbraco.Web.BackOffice/Controllers/AuthenticationController.cs
@@ -404,6 +404,9 @@ public class AuthenticationController : UmbracoApiControllerBase
         }
 
         BackOfficeIdentityUser? identityUser = await _userManager.FindByEmailAsync(model.Email);
+
+        await Task.Delay(RandomNumberGenerator.GetInt32(400, 2500)); // To randomize response time preventing user enumeration
+
         if (identityUser != null)
         {
             IUser? user = _userService.GetByEmail(model.Email);
@@ -424,14 +427,20 @@ public class AuthenticationController : UmbracoApiControllerBase
 
                 var mailMessage = new EmailMessage(from, user.Email, subject, message, true);
 
-                await _emailSender.SendAsync(mailMessage, Constants.Web.EmailTypes.PasswordReset, true);
+                try
+                {
+                    await _emailSender.SendAsync(mailMessage, Constants.Web.EmailTypes.PasswordReset, true);
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogError(ex, "Error sending email, please check your SMTP configuration: {ErrorMessage}", ex.Message);
+                    return Ok();
+                }
 
                 _userManager.NotifyForgotPasswordRequested(User, user.Id.ToString());
             }
         }
 
-        await Task.Delay(RandomNumberGenerator.GetInt32(400, 2500));
-
         return Ok();
     }
 
diff --git a/src/Umbraco.Web.UI.Client/src/common/resources/auth.resource.js b/src/Umbraco.Web.UI.Client/src/common/resources/auth.resource.js
index e09718176c..7b0a10cf31 100644
--- a/src/Umbraco.Web.UI.Client/src/common/resources/auth.resource.js
+++ b/src/Umbraco.Web.UI.Client/src/common/resources/auth.resource.js
@@ -28,7 +28,7 @@ function authResource($q, $http, umbRequestHelper, angularHelper) {
      *    });
      * </pre>
      * @returns {Promise} resourcePromise object
-     * 
+     *
      */
     get2FAProviders: function () {
 
@@ -203,7 +203,7 @@ function authResource($q, $http, umbRequestHelper, angularHelper) {
             "PostRequestPasswordReset"), {
             email: email
           }),
-        'Request password reset failed for email ' + email);
+        'An email with password reset instructions will be sent to the specified address if it matched our records');
     },
 
     /**
diff --git a/src/Umbraco.Web.UI.Client/src/views/components/application/umb-login.html b/src/Umbraco.Web.UI.Client/src/views/components/application/umb-login.html
index 4a9dc85865..69dc038cb8 100644
--- a/src/Umbraco.Web.UI.Client/src/views/components/application/umb-login.html
+++ b/src/Umbraco.Web.UI.Client/src/views/components/application/umb-login.html
@@ -158,7 +158,7 @@
                         </div>
 
                         <div ng-messages="vm.requestPasswordResetForm.$error" class="control-group" ng-show="vm.requestPasswordResetForm.$invalid">
-                            <p ng-message="auth" class="text-error" role="alert" tabindex="0">{{vm.errorMsg}}</p>
+                            <p ng-message="auth" class="text-info" role="alert" tabindex="0">{{vm.errorMsg}}</p>
                         </div>
 
                         <div class="control-group" ng-show="vm.showEmailResetConfirmation">