On private wikis (where wgBlockDisablesLogin is enabled), blocked users should not receive password reset emails when requested for their username. If they cannot access the content, there's no need to send the password.
Similar task: T54453, though that is more of a blanket eradication of watchlist notifications for the same users.
Hmmm. So we'd return an error saying that the account is blocked? It looks like we already expose account existence, so OK...
What are we going to do about email address-based password reset?
We return the block information in the user query api, so we already make that public.
What are we going to do about email address-based password reset?
I think we should take blocked users off the list of users who email matches the reset request. If no unblocked accounts are still in the list, then the resetting user gets the standard response that no user accounts have that email.
We expose the user query API on private wikis to logged out users? That's not what I was thinking of.
What are we going to do about email address-based password reset?
I think we should take blocked users off the list of users who email matches the reset request. If no unblocked accounts are still in the list, then the resetting user gets the standard response that no user accounts have that email.
I don't think we actually provide such an error? When I try resetting for completely nonsense email addresses (e.g. DoesNotActuallyExist@wikimedia.org), it pretends that it's sent an email.
What are we going to do about email address-based password reset?
I think we should take blocked users off the list of users who email matches the reset request. If no unblocked accounts are still in the list, then the resetting user gets the standard response that no user accounts have that email.
I don't think we actually provide such an error? When I try resetting for completely nonsense email addresses (e.g. DoesNotActuallyExist@wikimedia.org), it pretends that it's sent an email.
What's wrong with that? (My opinion is nothing - it also helps alleviate some of the other concern about being able to find out which accounts exist on the private wiki)