removed error output from user reset for rate limiting or incorrect email, so users cannot validate emails via this endpoint

src/socket.io/user.js

@@ -88,15 +88,20 @@ SocketUser.reset.send = function (socket, email, callback) {
 	}
 
 	user.reset.send(email, function (err) {
-		if (err && err.message !== '[[error:invalid-email]]') {
-			return callback(err);
-		}
-		if (err && err.message === '[[error:invalid-email]]') {
-			winston.verbose('[user/reset] Invalid email attempt: ' + email);
-			return setTimeout(callback, 2500);
+		if (err) {
+			switch (err.message) {
+			case '[[error:invalid-email]]':
+				winston.warn('[user/reset] Invalid email attempt: ' + email + ' by IP ' + socket.ip + (socket.uid ? ' (uid: ' + socket.uid + ')' : ''));
+				err = null;
+				break;
+
+			case '[[error:reset-rate-limited]]':
+				err = null;
+				break;
+			}
 		}
 
-		callback();
+		setTimeout(callback.bind(err), 2500);
 	});
 };
 

src/user/reset.js

@@ -51,7 +51,7 @@ function canGenerate(uid, callback) {
 		},
 		function (score, next) {
 			if (score > Date.now() - (1000 * 60)) {
-				return next(new Error('[[error:cant-reset-password-more-than-once-a-minute]]'));
+				return next(new Error('[[error:reset-rate-limited]]'));
 			}
 			next();
 		},