Make sure a password reset token can be used only once

2020-12-30 21:51:45 +01:00 · 2020-12-30 21:51:45 +01:00 · ac23536c36
commit ac23536c36
parent 787044628f
1 changed files with 2 additions and 0 deletions
--- a/pkg/user/user_password_reset.go
+++ b/pkg/user/user_password_reset.go
@ -63,7 +63,9 @@ func ResetPassword(s *xorm.Session, reset *PasswordReset) (err error) {
 	}

 	// Save it
+	user.PasswordResetToken = ""
 	_, err = s.
+		Cols("password", "password_reset_token").
 		Where("id = ?", user.ID).
 		Update(&user)
 	if err != nil {