mirror of
https://github.com/HeyPuter/puter.git
synced 2025-01-23 22:40:20 +08:00
Disable password reset token when email or password is changed
This commit is contained in:
parent
d58aa33d2b
commit
5890b7e7bf
@ -122,7 +122,7 @@ const CHANGE_EMAIL_CONFIRM = eggspress('/change_email/confirm', {
|
||||
const new_email = rows[0].unconfirmed_change_email;
|
||||
|
||||
await db.write(
|
||||
'UPDATE `user` SET `email` = ?, `unconfirmed_change_email` = NULL, `change_email_confirm_token` = NULL WHERE `id` = ?',
|
||||
'UPDATE `user` SET `email` = ?, `unconfirmed_change_email` = NULL, `change_email_confirm_token` = NULL, `pass_recovery_token` = NULL WHERE `id` = ?',
|
||||
[new_email, user_id]
|
||||
);
|
||||
|
||||
|
@ -62,7 +62,7 @@ router.post('/passwd', auth, express.json(), async (req, res, next)=>{
|
||||
return res.status(400).send('new_pass must be at least 6 characters long.')
|
||||
else{
|
||||
await db.write(
|
||||
'UPDATE user SET password=? WHERE `id` = ?',
|
||||
'UPDATE user SET password=?, `pass_recovery_token` = NULL WHERE `id` = ?',
|
||||
[await bcrypt.hash(req.body.new_pass, 8), req.user.id]
|
||||
);
|
||||
invalidate_cached_user(req.user);
|
||||
|
Loading…
Reference in New Issue
Block a user