[5.2] Separate activation from resetToken

administrator/components/com_admin/sql/updates/mysql/4.0.0-2021-03-15.sql

@@ -0,0 +1 @@
+ALTER TABLE `#__users` ADD COLUMN `resetToken` varchar(100) NOT NULL DEFAULT '';

administrator/components/com_admin/sql/updates/postgresql/4.0.0-2021-03-15.sql

@@ -0,0 +1 @@
+ALTER TABLE "#__users" ADD COLUMN "resetToken" varchar(100) DEFAULT '' NOT NULL;

components/com_users/src/Model/ResetModel.php

@@ -208,7 +208,7 @@ public function processResetComplete($data)
         $app->getDispatcher()->dispatch($event->getName(), $event);
 
         // Check for a user and that the tokens match.
-        if (empty($user) || $user->activation !== $token) {
+        if (empty($user) || $user->resetToken !== $token) {
             $this->setError(Text::_('COM_USERS_USER_NOT_FOUND'));
 
             return false;
@@ -230,7 +230,7 @@ public function processResetComplete($data)
 
         // Prepare user data.
         $data['password']   = $data['password1'];
-        $data['activation'] = '';
+        $data['resetToken'] = '';
 
         // Update the user object.
         if (!$user->bind($data)) {
@@ -302,7 +302,7 @@ public function processResetConfirm($data)
         // Find the user id for the given token.
         $db    = $this->getDatabase();
         $query = $db->getQuery(true)
-            ->select($db->quoteName(['activation', 'id', 'block']))
+            ->select($db->quoteName(['activation', 'resetToken', 'lastResetTime', 'id', 'block']))
             ->from($db->quoteName('#__users'))
             ->where($db->quoteName('username') . ' = :username')
             ->bind(':username', $data['username']);
@@ -323,14 +323,14 @@ public function processResetConfirm($data)
             return false;
         }
 
-        if (!$user->activation) {
+        if ($user->activation) {
             $this->setError(Text::_('COM_USERS_USER_NOT_FOUND'));
 
             return false;
         }
 
         // Verify the token
-        if (!UserHelper::verifyPassword($data['token'], $user->activation)) {
+        if (!UserHelper::verifyPassword($data['token'], $user->resetToken)) {
             $this->setError(Text::_('COM_USERS_USER_NOT_FOUND'));
 
             return false;
@@ -343,9 +343,21 @@ public function processResetConfirm($data)
             return false;
         }
 
+        // Check if the token is expired or not
+        $now       = Factory::getDate();
+        $lastReset = Factory::getDate($user->lastResetTime);
+
+        $now->modify('-3 days');
+
+        if ($now > $lastReset) {
+            $this->setError(Text::_('COM_USERS_RESET_TOKEN_EXPIRED'));
+
+            return false;
+        }
+
         // Push the user data into the session.
         $app = Factory::getApplication();
-        $app->setUserState('com_users.reset.token', $user->activation);
+        $app->setUserState('com_users.reset.token', $user->resetToken);
         $app->setUserState('com_users.reset.user', $user->id);
 
         return true;
@@ -449,7 +461,7 @@ public function processResetRequest($data)
         $token       = ApplicationHelper::getHash(UserHelper::genRandomPassword());
         $hashedToken = UserHelper::hashPassword($token);
 
-        $user->activation = $hashedToken;
+        $user->resetToken = $hashedToken;
 
         $event = AbstractEvent::create(
             'onUserBeforeResetRequest',

installation/sql/mysql/base.sql

@@ -994,6 +994,7 @@ CREATE TABLE IF NOT EXISTS `#__users` (
   `registerDate` datetime NOT NULL,
   `lastvisitDate` datetime,
   `activation` varchar(100) NOT NULL DEFAULT '',
+  `resetToken` varchar(100) NOT NULL DEFAULT '',
   `params` text NOT NULL,
   `lastResetTime` datetime COMMENT 'Date of last password reset',
   `resetCount` int NOT NULL DEFAULT 0 COMMENT 'Count of password resets since lastResetTime',

installation/sql/postgresql/base.sql

@@ -1017,6 +1017,7 @@ CREATE TABLE IF NOT EXISTS "#__users" (
   "registerDate" timestamp without time zone NOT NULL,
   "lastvisitDate" timestamp without time zone,
   "activation" varchar(100) DEFAULT '' NOT NULL,
+  "resetToken" varchar(100) DEFAULT '' NOT NULL,
   "params" text NOT NULL,
   "lastResetTime" timestamp without time zone,
   "resetCount" bigint DEFAULT 0 NOT NULL,

language/en-GB/com_users.ini

@@ -139,6 +139,7 @@ COM_USERS_RESET_REQUEST="If the email address you entered is registered on this
 COM_USERS_RESET_REQUEST_ERROR="Error requesting password reset."
 COM_USERS_RESET_REQUEST_FAILED="Reset password failed: %s"
 COM_USERS_RESET_REQUEST_LABEL="Please enter the email address for your account. A verification code will be sent to you. Once you have received the verification code, you will be able to choose a new password for your account."
+COM_USERS_RESET_TOKEN_EXPIRED="Verification code has expired, please request a new one."
 COM_USERS_SETTINGS_FIELDSET_LABEL="Basic Settings"
 COM_USERS_USER_BACKUPCODE="Backup Code"
 COM_USERS_USER_BACKUPCODES="Backup Codes"