litvinovg/vitro
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use unique key in account activation link and reset password link (#234)

Browse source 
* Use unique key for email activation and password reset

* Renamed old variable from hash to key

* Check for null before setting email key for backward compatibility. Removed comment about old behaviour.

* Send password_change_invalid_key message instead of password_change_not_pending on key mismatch.
This commit is contained in:
Georgy Litvinov 2021-06-03 14:59:29 +02:00 • committed by GitHub
parent 3c04cc0f80
commit d21dc92b0b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
17 changed files with 59 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

2
webapp/src/main/webapp/templates/freemarker/body/accounts/userAccounts-createPassword.ftl
View file

@ -26,7 +26,7 @@
<form method="POST" action="${formUrls.createPassword}" class="customForm" role="create password">
<input type="hidden" name="user" value="${userAccount.emailAddress}" role="input" />
<input type="hidden" name="key" value="${userAccount.passwordLinkExpiresHash}" role="input" />
<input type="hidden" name="key" value="${userAccount.emailKey}" role="input" />
<label for="new-password">${strings.new_password}<span class="requiredHint"> *</span></label>
<input type="password" name="newPassword" value="${newPassword}" id="new-password" role="input" />

2
webapp/src/main/webapp/templates/freemarker/body/accounts/userAccounts-resetPassword.ftl
View file

@ -26,7 +26,7 @@
<section id="reset-password" role="region">
<form method="POST" action="${formUrls.resetPassword}" class="customForm" role="create password">
<input type="hidden" name="user" value="${userAccount.emailAddress}" />
<input type="hidden" name="key" value="${userAccount.passwordLinkExpiresHash}" />
<input type="hidden" name="key" value="${userAccount.emailKey}" />
<label for="new-password">${strings.new_password}<span class="requiredHint"> *</span></label>
<input type="password" name="newPassword" value="${newPassword}" id="new-password" role="input" />