From aca44ddd5c0999b4aa660d1b9aa009d23fd766e7 Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Fri, 23 Oct 2026 13:12:17 +0200 Subject: [PATCH] Fix (security): don't accept empty reset keys for users with no password reset pending Currently, it's possible to reset passwords for users that do not have any password reset by providing an empty key, which would match '' or NULL. --- models/Authentication.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/models/Authentication.php b/models/Authentication.php index 1560dbb..46e573c 100644 --- a/models/Authentication.php +++ b/models/Authentication.php @@ -37,6 +37,10 @@ class Authentication public static function checkResetKey($id_user, $reset_key) { + // Users without a pending reset have a blank key, which must never match. + if (!is_string($reset_key) || $reset_key === '') + return false; + $key = Registry::get('db')->queryValue(' SELECT reset_key FROM users @@ -45,7 +49,10 @@ class Authentication 'id' => $id_user, ]); - return $key == $reset_key; + if (!is_string($key) || $key === '') + return false; + + return hash_equals($key, $reset_key); } /**