From 1eb0df6aaa790e4190ffab806cc7f99f799ef75c Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Sat, 24 Oct 2026 18:05:44 +0200 Subject: [PATCH] Fix (security): don't accept empty reset keys for users with no password reset pending (#57) Currently, it's possible to reset passwords for users that do not have any password reset by providing an empty key, which would match '' or NULL. Reviewed-on: https://gitea.hashru.nl/Public/pics/pulls/57 Reviewed-by: Aaron van Geffen Co-authored-by: Yorick van Pelt --- models/Authentication.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/models/Authentication.php b/models/Authentication.php index 1560dbb..46e573c 100644 --- a/models/Authentication.php +++ b/models/Authentication.php @@ -37,6 +37,10 @@ class Authentication public static function checkResetKey($id_user, $reset_key) { + // Users without a pending reset have a blank key, which must never match. + if (!is_string($reset_key) || $reset_key === '') + return false; + $key = Registry::get('db')->queryValue(' SELECT reset_key FROM users @@ -45,7 +49,10 @@ class Authentication 'id' => $id_user, ]); - return $key == $reset_key; + if (!is_string($key) || $key === '') + return false; + + return hash_equals($key, $reset_key); } /**