Redmine

I was able to reproduce the issue where the IP address is blank in the security notification when a password is changed using a password recovery token.

The cause is that the password reset flow in AccountController#lost_password runs while the user is not logged in. In a normal logged-in request, ApplicationController#find_current_user identifies the current user and sets request.remote_ip on that user object. However, in the password reset flow using a recovery token, User.current remains User.anonymous, and Mailer.deliver_password_updated(@user, User.current) passes the anonymous user as the sender of the security notification. As a result, sender.remote_ip is nil, and the remote IP address is blank in the security notification.

The attached patch fixes this issue. It sets request.remote_ip on the user whose password was successfully reset, and then calls Mailer.deliver_password_updated(@user, @user). This makes the security notification show the affected user and the request IP address correctly, as it does for normal password changes by logged-in users.

Damiano Sparta wrote in #note-3:

Thanks to the patch you provided, the IP address and account are now included in the notification email.

Thank you for testing the patch. The fix will be delivered in the next maintenance release.

Committed the fix in r24808.