reset password error

[Damindu71]

No description provided.

[ARGO1960]

Not Sure what the problem should be ;-)
But what I found is the password reset url can be used if the password has been reset by that link before.
I think it should be invalidated when used one time.

other issue is the validation link that comes with password reset and very email...
it starts with localhost/logonsystem/ and it should be the actual host.

[msaad1999]

I will update the token security, it really is weak if it can be reused like that again.
As for the localhost urls, I will make a host entry in env files to manually set the desired Host. I'll get to these as soon as I get time

[zotz]

I just did that this morning like this:

At the bottom of env.php:

if (!defined('WEB_ADDRESS')) define('WEB_ADDRESS', 'http://bahamianornuttin.com/'); if (!defined('WEB_DIR')) define('WEB_DIR', 'rivz/test11/');

in register/includes/sendverificationemail.inc.php:
$url = WEB_ADDRESS . WEB_DIR . "verify/includes/verify.inc.php?selector=" . $selector . "&validator=" . bin2hex($token);

in verify/includes/sendverificationemail.inc.php:
$url = WEB_ADDRESS . WEB_DIR . "verify/includes/verify.inc.php?selector=" . $selector . "&validator=" . bin2hex($token);

in reset-password/includes/sendtoken.inc.php:
$url = WEB_ADDRESS . WEB_DIR . "reset-password/?selector=" . $selector . "&validator=" . bin2hex($token);

Not sure this is the best way to go about it but it seems to be working.

all the best,

drew

[msaad1999]

@zotz thanks for the quick fix, I may improve on it in the future, but currently, since you are the one who implemented the fix, why not make a pull request to the original repo as your own contribution.
Thanks for the fix. I apologize for the lack of active support I can provide at the moment due to some work, but I really appreciate any effort from you guys.

[zotz]

I would be happy to do things that way, I just need to figure out how. My remembered git skills are lacking. If there is a two sentence explanation you can give that I can follow, I will jump on it. If not, it may take a bit for me to figure it out. all the best, drew

…

On Fri, Jan 15, 2021 at 2:08 AM Muhammad Saad ***@***.***> wrote: @zotz <https://github.com/zotz> thanks for the quick fix, I may improve on it in the future, but currently, since you are the one who implemented the fix, why not make a pull request to the original repo as your own contribution. Thanks for the fix. I apologize for the lack of active support I can provide at the moment due to some work, but I really appreciate any effort from you guys. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#24 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEWEDUKGVDBIEY6BIPODHTSZ7SVFANCNFSM4UM3UFOQ> .

-- Enjoy the *Paradise Island Cam* playing *Bahamian Or Nuttin* - https://www.paradiseislandcam.com/

[msaad1999]

Ah no problem. Just make the required changes to your code, then make a Pull Request from that to this main repository. I'll review the changes and accept it, which will include and show your contributions in the repository.