TYPO3 Core

To prevent information disclosure, the password reset process does not reveal if an email was sent or not (since the methods just return void).

However, the ResetPasswordCommand will always display a success message Sent out an email to "some@email.com" requesting to set a new password., as soon as the input arguments are valid and password reset is enabled. But in case a password reset for an admin user is requested, while passwordResetForAdmins is not enabled, no email will be sent. So the message is highly misleading.

To fix this, the message should only inform about the successfully initiated password reset process.