Union/ProjectLighthouse
1
0
Fork 0
mirror of https://github.com/LBPUnion/ProjectLighthouse.git synced 2025-07-31 17:28:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Prevent password reset spam (#973)

Browse source 
* Remove password reset tokens after 1 day and only allow 1 at a time

* Update expiration hint in email to reflect actual time
This commit is contained in:
Josh 2024-02-01 21:12:37 -06:00 • committed by GitHub
commit fc3f033705
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
ProjectLighthouse/Database/DatabaseContext.WebTokens.cs
View file

@ -104,6 +104,7 @@ public partial class DatabaseContext
await this.WebTokens.RemoveWhere(t => DateTime.UtcNow > t.ExpiresAt);
await this.EmailVerificationTokens.RemoveWhere(t => DateTime.UtcNow > t.ExpiresAt);
await this.EmailSetTokens.RemoveWhere(t => DateTime.UtcNow > t.ExpiresAt);
await this.PasswordResetTokens.RemoveWhere(t => DateTime.UtcNow > t.Created.AddDays(1));
}
public async Task RemoveRegistrationToken(string? tokenString)

5
ProjectLighthouse/Helpers/EmailHelper.cs
View file

@ -46,6 +46,8 @@ public static class SMTPHelper
{
if (!CanSendMail(user)) return;
if (await database.PasswordResetTokens.CountAsync(t => t.UserId == user.UserId) > 0) return;
PasswordResetTokenEntity token = new()
{
Created = DateTime.UtcNow,
@ -59,7 +61,8 @@ public static class SMTPHelper
string messageBody = $"Hello, {user.Username}.\n\n" +
"A request to reset your account's password was issued. If this wasn't you, this can probably be ignored.\n\n" +
$"If this was you, your {ServerConfiguration.Instance.Customization.ServerName} password can be reset at the following link:\n" +
$"{ServerConfiguration.Instance.ExternalUrl}/passwordReset?token={token.ResetToken}";
$"{ServerConfiguration.Instance.ExternalUrl}/passwordReset?token={token.ResetToken}\n\n" +
"This link will expire in 24 hours";
await mail.SendEmailAsync(user.EmailAddress, $"Project Lighthouse Password Reset Request for {user.Username}", messageBody);