[solidus_storefront] [GHSA-mhwq-2v9w-r659] Storefront password reset endpoint allows for account enumeration

[Jared Norman]

Versions Affected: All storefronts generated by `solidus:install` (Solidus Storefront, previously Solidus Starter Frontend)
Not affected: Stores using solidus_frontend (see GHSA-mc6q-7qq6-ghg8) or a custom-built storefront
Fixed Versions: Generator templates fixed; existing applications must patch their own code (see Workarounds)

Impact
------

The storefront password endpoint (`/password/recover`) allows for account
enumeration and Devise's paranoid mode is ignored.

Patches
-------

The storefront generator templates are fixed in Solidus, so new stores will
get the patched code.

**Upgrading the Solidus gem does not fix existing stores.** The vulnerable
code was copied into your application when the storefront was generated, so
every existing store must patch its own `UserPasswordsController`. The fix is
in the Workarounds section below.

The admin password reset endpoint has the same issue and is fixed in
`solidus_auth_devise` 2.6.1. See GHSA-mc6q-7qq6-ghg8.

Workarounds
-----------

In your application, edit `app/controllers/user_passwords_controller.rb` so
that `create` uses Devise's `successfully_sent?`:

        set_flash_message(:notice, :send_instructions) if is_navigational_format?

    -   if resource.errors.empty?
    +   if successfully_sent?(resource)
          respond_with resource, location: login_path
        else
          respond_with_navigational(resource) { render :new }

This change applies to any Solidus version; you do not need to upgrade first.

References
----------

* https://github.com/solidusio/solidus/security/advisories/GHSA-mhwq-2v9w-r659
* https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-mc6q-7qq6-ghg8 (companion advisory for solidus_auth_devise)
* https://github.com/heartcombo/devise/wiki/How-To:-Using-paranoid-mode,-avoid-user-enumeration-on-registerable (Devise's paranoid mode)

If you have any questions about how to secure your site please stop by our
Slack: http://slack.solidus.io/