SUM-SEC-11 [P1][11/20][Med] Ignore client-supplied login_url on password reset RPC

[CHINMAYVIVEK]

ID: SUM-SEC-11
Wave: P1
Severity: Medium
Labels: security, phishing, mail, P1, medium
Branch: fix/SUM-SEC-11-reset-password-login-url
Languages: Go
CWE: CWE-601 / phishing

Summary

action_reset_password uses client vals["login_url"] unsanitized in the email. Web UI may default to /web/login, but RPC callers can inject https://evil.example/... into reset mail.

Track

loginURL := strings.TrimSpace(vals["login_url"])
if loginURL == "" {
    loginURL = "/web/login"
}
// no allowlist — used in SendPasswordResetEmail

Acceptance criteria

• Ignore client URL; use config base URL + /web/login only
• If absolute URLs allowed, allowlist host against web.base.url / config
• Test: malicious login_url not present in outbound mail payload

Files to check / change

• sumeru/addons/base/user_object_actions.go (~L47–53)
• Mail send helpers used by reset