reset_password API to always return success

[anhcuky]

No description provided.

[phiresky]

Theoretically (for security), it would be better if this endpoint returned success regardless of registration state (with undistinguishable timing). The corresponding UI text as is common in other websites would be "If this email address has a registered account, it has been sent a password reset email."

Otherwise, as is, we have an email enumeration vulnerability. As in, you can find registered users by calling this endpoint and collecting success responses, which you can then use to target those users specifically using leaked password lists.

[anhcuky]

@phiresky Thanks, your suggestion aligns with my concern in #5277. (I closed it because I thought it was unnecessary, lol). Will make this change in this PR

[dessalines]

We should also probably just remove the CouldntFindEmail error.

[SleeplessOne1917]

Seconding Dessalines on removing the CouldntFindEmail error. Best to make it so that an attacker can't deduce whether an email or username is in use by looking at responses.

[anhcuky]

Updated this PR

[dullbananas]

Since errors when sending the email are now ignored, the text shown in lemmy-ui should suggest trying again later if nothing happens

[dessalines]

Should be moved to utils like all the other helper functions. And you should add a function comment that it always returns Ok, and probably link to the issue.

[dullbananas]

I think it's a little better to keep the reset_password and try_reset_password functions together

[dessalines]

You also need to remove the CouldntFindEmail error.