Change Details

Per the security@ email from 11/20/2018, usernames are auto-filled/suggested within the Username form field on various Mediawiki installs, e.g. https://en.m.wikipedia.org/wiki/Special:PasswordReset. For public-facing wikis, username by itself is considered to be public data and searchable in any number of ways (api, specialpages, quarry, etc.) However, we should discourage any potential abuse (and confusion from regular users) by removing this feature from the password reset form, an obvious target of nefarious users. There is also at least a moderate performance issue here, querying the db on each keystroke as noted by @jcrespo.

Per the security@ email from 11/20/2018, usernames are auto-filled/suggested within the Username form field on various Mediawiki installs, e.g. https://en.m.wikipedia.org/wiki/Special:PasswordReset. For public-facing wikis, username by itself is considered to be public data and searchable in any number of ways (api, specialpages, quarry, etc.) However, we should discourage any potential abuse (and confusion from regular users) by ~~removing~~ disabling this feature **on foundation wikis** from the password reset form, an obvious target of nefarious users. There is also at least a moderate performance issue here, querying the db on each keystroke as noted by @jcrespo.

Per the security@ email from 11/20/2018, usernames are auto-filled/suggested within the Username form field on various Mediawiki installs, e.g. https://en.m.wikipedia.org/wiki/Special:PasswordReset. For public-facing wikis, username by itself is considered to be public data and searchable in any number of ways (api, specialpages, quarry, etc.) However, we should discourage any potential abuse (and confusion from regular users) by ~~removing~~ disabling this feature **on foundation wikis** from the password reset form, an obvious target of nefarious users. There is also at least a moderate performance issue here, querying the db on each keystroke as noted by @jcrespo.