Merge pull request #67 from phpbb/ticket/security-274

[ticket/security/274] Reset login keys/session when resetting password
phpbb · Nov 22, 2022 · e75ea66 · e75ea66
2 parents 0793126 + 827c135
commit e75ea66
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/phpBB/phpbb/ucp/controller/reset_password.php b/phpBB/phpbb/ucp/controller/reset_password.php
@@ -415,6 +415,7 @@ public function reset()
 							SET ' . $this->db->sql_build_array('UPDATE', $sql_ary) . '
 							WHERE user_id = ' . (int) $user_row['user_id'];
 				$this->db->sql_query($sql);
+				$this->user->reset_login_keys();
 				$this->log->add('user', $user_row['user_id'], $this->user->ip, 'LOG_USER_NEW_PASSWORD', false, [
 					'reportee_id' => $user_row['user_id'],
 					$user_row['username']