attemptReset does not check for token existance before resetting passwd

[fefo-p]

Just adding a second 'where' condition will do:
$user = $users->where('email', $this->request->getPost('email'))->where('reset_hash', $this->request->getPost('token'))->first();

On the other hand, what's the logic you thought for "reset-time" field in DB?
I guess it'd mean that you could put a certain amount of minutes of token validity that could be checked just after the $user = $user->where()...->first() above. Am I right?

[fefo-p]

As it is now, it allows infinite password resets, even with no valid token