generate bad request on password reset with missing email address

devel0 · devel0 · commit cf4ca8a22986 · 2024-10-30T21:36:53.000+01:00
diff --git a/src/app/backend/Controllers/AuthController.cs b/src/app/backend/Controllers/AuthController.cs
@@ -217,8 +217,11 @@ public async Task<ActionResult<EditUserResponseDto>> EditUser(EditUserRequestDto
     /// </summary>    
     [HttpGet]
     [AllowAnonymous]
-    public async Task<ActionResult> ResetLostPassword(string email, string? token, string? resetPassword)
+    public async Task<ActionResult> ResetLostPassword(string? email, string? token, string? resetPassword)
     {
+        if (email is null)
+            throw new BadHttpRequestException("Email address required.");
+
         var res = await authService.ResetLostPasswordRequestAsync(
             email,
             token,
