mirrors/puter
1
0
Fork 0
mirror of https://github.com/HeyPuter/puter synced 2024-11-15 06:15:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Invalidate email confirmation on password change

Browse Source
This commit is contained in:
KernelDeimos 2024-05-08 22:28:41 -04:00
parent 45e7f162a2
commit df24c663df
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
packages/backend/src/routers/passwd.js
View File

@ -62,7 +62,7 @@ router.post('/passwd', auth, express.json(), async (req, res, next)=>{
return res.status(400).send('new_pass must be at least 6 characters long.')
else{
await db.write(
'UPDATE user SET password=?, `pass_recovery_token` = NULL WHERE `id` = ?',
'UPDATE user SET password=?, `pass_recovery_token` = NULL, `change_email_confirm_token` = NULL WHERE `id` = ?',
[await bcrypt.hash(req.body.new_pass, 8), req.user.id]
);
invalidate_cached_user(req.user);

2
packages/backend/src/routers/set-pass-using-token.js
View File

@ -68,7 +68,7 @@ router.post('/set-pass-using-token', express.json(), async (req, res, next)=>{
try{
const info = await db.write(
'UPDATE user SET password=?, pass_recovery_token=NULL WHERE `uuid` = ? AND pass_recovery_token = ?',
'UPDATE user SET password=?, pass_recovery_token=NULL, change_email_confirm_token=NULL WHERE `uuid` = ? AND pass_recovery_token = ?',
[await bcrypt.hash(req.body.password, 8), user_uid, token],
);