yorick
1eb0df6aaa
Fix (security): don't accept empty reset keys for users with no password reset pending ( #57 )
...
Currently, it's possible to reset passwords for users that do not have any password reset by providing an empty key, which would match '' or NULL.
Reviewed-on: #57
Reviewed-by: Aaron van Geffen <aaron@aaronweb.net >
Co-authored-by: Yorick van Pelt <yorick@yorickvanpelt.nl >
2026-10-24 18:05:44 +02:00
Aaron
913fb974c7
Fix two more stray queries
2025-09-18 11:10:04 +02:00
Aaron
48377ec823
Update stray queries to PDO-style parameters
2025-09-18 11:07:55 +02:00
Aaron
8dbf1dce7b
Database: start reworking the DBA to work with PDO
2025-05-13 20:51:43 +02:00
Aaron
adfb5a2198
ResetPassword: add time-out to password resets; prevent repeated mails
2024-11-05 17:19:59 +01:00
Aaron
084658820e
Authentication: replace checkExists with Member::fromId
2024-11-05 16:46:53 +01:00
Aaron
8eaeb6c332
Authentication: remove remnants of user agent checks
2024-11-05 16:45:40 +01:00
Aaron
9c86d2c475
Authentication: replace getUserId with Member::fromEmailAddress
2024-11-05 16:44:54 +01:00
Aaron
3de4e9391c
Authentication: reorder methods alphabetically
2024-11-05 16:39:42 +01:00
Aaron
7487068171
Allow resetting password through email.
...
This also adopts the use of an Alert template for error and success messages.
2017-11-09 17:00:34 +01:00
Aaron
ab0e4efbcb
Initial commit.
...
This is to be the new HashRU website based on the Aaronweb.net/Kabuki CMS.
2017-11-09 17:00:22 +01:00
yorick
Aaron