[cloud][CLOUD-127] Disable site-admin access to reset password link on Cloud
Created by: kopancek
Description
Disable site-admin access to reset password link on Cloud. Exposing the password reset link could lead to hostile user account takeover by a bad acting site-admin. This would have bad impact on the security reputation of sourcegraph.com
Screenshots
Old behaviour
This is the current behaviour. We will continue behaving like this if not on cloud
New behavior
Testing locally
To test this change locally, do the following:
Old behavior
- Run
sg start enterprise
- Make sure you have at least 2 users, one of which is site-admin
- Login as a site-admin and go to https://sourcegraph.test:3443/site-admin/users
- Click on
Reset password
button of the other user - You should see the reset password link in the success message (old behavior mentioned above)
New behavior
- Run
sg start cloud
- Make sure you have at least 2 users, one of which is site-admin
- Login as a site-admin and go to https://sourcegraph.test:3443/site-admin/users
- Click on
Reset password
button of the other user - You should NOT see the reset password link in the success message (new behavior mentioned above)