Reset password keep success

[YousefAlsbaihi]

Issue Description

Reset password keep giving Password reset request was sent successfully even when the email not exists or even if the email field empty

Steps to reproduce

as you can see in this code, the email is empty but it still show me the the email sent,
when i try to put an any email i get the same results.

Parse.User.requestPasswordReset("  ").then(function () {
      console.log("Password reset request was sent successfully");
}).catch(function (error) {
    console.log("The login failed with error: " + error.code + " " + error.message);
});

Expected Results

expected to show error

Actual Outcome

no debug code show up, nothing except whatever in the success point.

Environment Setup

• Server

  • parse-server version : 3.9.0
  • Operating System: N/A " Using Back4App"
  • Hardware: N/A " Using Back4App"
  • Localhost or remote server?: remote Using Back4App

• JS SDK

  • JS SDK version: "^2.12.0"
  • Application?: React-Native

[TomWFox]

This is actually expected behaviour. Please see the below except from a Stack Overflow answer...

Pre 3.1.0 of Parse Server the request to reset a password returned an error if the email address was not found however this is a security risk as it allows an attacker to obtain user data - see this explanation.

You can also take a look at the changelog and the PR that implemented this change.