- Se descapó
- 23 de septiembre de 2026 a las 22:14 UTC
- Autor
- Kamo
- Compromit
- 99a97ee
Forgot-password resets go to the address on the user account, usually a personal one, but members type the work address their organization gave them. SecurityService now recognises a work address and answers 409 WORK_EMAIL with personalEmailHint, the account address masked. Nothing is sent. The wizard shows that in place of "check your inbox": the address they typed, the masked hint on a line of its own, and the field cleared, relabelled "Personal email address", focused, with the hint as its placeholder. The *** stays solved, since the member is being helped along rather than refused. Entering the personal address carries on to the code step as before. /recover's email step shows the same answer as an info message instead of "Failed to send recovery email".