Security
- Signing up with an email address that already has an ISO Mate account no longer reveals that the address is taken. Sign-up now answers the same way either way, so the form can no longer be used to work out whether an arbitrary email address belongs to an ISO Mate customer. When the address does already have an account, we email its owner to tell them, so anyone who had forgotten they were already signed up still finds out and can sign in rather than waiting for a verification link that was never coming. Requesting a new invitation link could reveal the same thing and was changed with it. Reported to us externally with a clear, reproducible proof of concept.
Fixes
- File sizes shown for uploaded images and attachments are now accurate. Uploads are cleaned as they are stored, and the recorded size described the file as submitted rather than the file as kept, so the figure could be slightly off. Prompted by an external report.