yorick 1eb0df6aaa Fix (security): don't accept empty reset keys for users with no password reset pending (#57) ...

Currently, it's possible to reset passwords for users that do not have any password reset by providing an empty key, which would match '' or NULL.

Reviewed-on: #57
Reviewed-by: Aaron van Geffen <aaron@aaronweb.net>
Co-authored-by: Yorick van Pelt <yorick@yorickvanpelt.nl>

2026-10-24 18:05:44 +02:00

..

AdminMenu.php

Misc: use the correct copyright headers

2023-04-08 21:32:38 +02:00

Asset.php

Update stray queries to PDO-style parameters

2025-09-18 11:07:55 +02:00

AssetIterator.php

Update stray queries to PDO-style parameters

2025-09-18 11:07:55 +02:00

Authentication.php

Fix (security): don't accept empty reset keys for users with no password reset pending (#57)

2026-10-24 18:05:44 +02:00

CachedPDOIterator.php

CachedPDOIterator: introduce rewindable PDOStatement iterator

2025-05-13 22:51:12 +02:00

Database.php

Database: start reworking the DBA to work with PDO

2025-05-13 20:51:43 +02:00

Dispatcher.php

ErrorPage: display debug info in separate box

2025-02-26 15:33:18 +01:00

Email.php

Update stray queries to PDO-style parameters

2025-09-18 11:07:55 +02:00

ErrorHandler.php

ErrorPage: display debug info in separate box

2025-02-26 15:33:18 +01:00

ErrorLog.php

Database: start reworking the DBA to work with PDO

2025-05-13 20:51:43 +02:00

EXIF.php

EXIF: add special handling for Pentax Model/Make pollution

2024-01-11 18:45:22 +01:00

Form.php

Form: reorder class properties and rework constructor

2025-09-11 20:01:36 +02:00

GenericTable.php

GenericTable: better handling of null values for timestamps

2025-05-16 11:54:05 +02:00

Guest.php

Address dynamic class property deprecation warnings

2022-12-25 13:56:42 +01:00

Image.php

Database: start reworking the DBA to work with PDO

2025-05-13 20:51:43 +02:00

MainMenu.php

Misc: use the correct copyright headers

2023-04-08 21:32:38 +02:00

Member.php

Member: set empty reset key for new users

2025-05-16 11:53:59 +02:00

Menu.php

Misc: use the correct copyright headers

2023-04-08 21:32:38 +02:00

NotAllowedException.php

Initial commit.

2017-11-09 17:00:22 +01:00

NotFoundException.php

Initial commit.

2017-11-09 17:00:22 +01:00

PageIndex.php

PageIndex: rewrite getLink to be way less messy

2024-01-15 00:51:06 +01:00

PhotoMosaic.php

AssetIterator: rewrite to standard Iterator interface

2025-05-13 23:29:43 +02:00

Registry.php

Replace deprecated trigger_error calls with exceptions

2025-02-13 11:38:45 +01:00

Router.php

AccountSettings: allow users to change their personal details

2023-03-11 15:32:07 +01:00

Session.php

Replace deprecated trigger_error calls with exceptions

2025-02-13 11:38:45 +01:00

Setting.php

Database: start reworking the DBA to work with PDO

2025-05-13 20:51:43 +02:00

Tag.php

Tag: invert behaviour of getCount and getOffset methods

2026-02-14 12:56:50 +01:00

Thumbnail.php

Asset/Thumbnail: replace 'NULL' placeholder strings with actual null values

2025-05-16 11:57:07 +02:00

User.php

ResetPassword: add time-out to password resets; prevent repeated mails

2024-11-05 17:19:59 +01:00

UserFacingException.php

Allow resetting password through email.

2017-11-09 17:00:34 +01:00

UserMenu.php

Misc: use the correct copyright headers

2023-04-08 21:32:38 +02:00