function check_code() {
$code = $this->trimmed('code');
- $confirm = Confirm_address::staticGet($code);
+ $confirm = Confirm_address::staticGet('code', $code);
if (!$confirm) {
$this->client_error(_('No such recovery code.'));
# Note: it's still deleted; let's avoid a second attempt!
if ((time() - $touched) > MAX_RECOVERY_TIME) {
+ common_log(LOG_WARNING,
+ 'Attempted redemption on recovery code ' .
+ 'that is ' . $touched . ' seconds old. ');
$this->client_error(_('This confirmation code is too old. ' .
'Please start again.'));
return;
if ($msg) {
common_element('div', 'error', $msg);
} else {
- common_element('div', 'instructions',
+ common_element_start('div', 'instructions');
+ common_element('p', NULL,
_('If you\'ve forgotten or lost your' .
- ' password, you can get a new one sent ' .
+ ' password, you can get a new one sent to' .
' the email address you have stored ' .
' in your account.'));
+ common_element_end('div');
}
}
common_element_start('form', array('method' => 'post',
'id' => 'recoverpassword',
'action' => common_local_url('recoverpassword')));
+ common_hidden('token', common_session_token());
common_password('newpassword', _('New password'),
_('6 or more characters, and don\'t forget it!'));
common_password('confirm', _('Confirm'),
function reset_password() {
+ # CSRF protection
+ $token = $this->trimmed('token');
+ if (!$token || $token != common_session_token()) {
+ $this->show_form(_('There was a problem with your session token. Try again, please.'));
+ return;
+ }
+
$user = $this->get_temp_user();
if (!$user) {