Password reset email poisoning

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 6.1 EE GA3 (6.1.30), 6.2 EE GA1 (6.2.10)
• Fix Version/s: 6.1.X EE, 6.2.X EE
• Component/s: Application Security
• Labels:
  • 61-ee-ga3-sp3
  • 62-ee-sp8
  • 62-ee-sp9
  • liferay-fixpack-administration-7-6210
  • liferay-fixpack-misc-6-6210
  • liferay-fixpack-platform-24-6210
  • liferay-fixpack-platform-26-6130
  • liferay-fixpack-wcm-core-18-6210

Password reset email poisoning

New Portal Property

    #
    # Input a list of comma delimited valid domains and IPs that the portal is
    # allowed to use.
    #
    virtual.hosts.valid.hosts=*
    #virtual.hosts.valid.hosts=localhost,127.0.0.1,[::1],[0:0:0:0:0:0:0:1]