Documenting changes in passwort reset endpoint

Sylius · Jan 11, 2020 · f5522ac · f5522ac
1 parent 55ba20c
commit f5522ac
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/UPGRADE.md b/UPGRADE.md
@@ -7,6 +7,7 @@ access_control:
     - { path: "%sylius_shop_api.security.regex%/me", role: ROLE_USER}
 
 ```
+* The forgot passwort function now doesn't return an error if the user with this email is not found. It might give a potential attacker information about which users are registered in the shop.
 
 # UPGRADE FROM 1.0.0-rc.2 or 1.0.0-rc.3 to 1.0.0