zydronium/neocities
1
0
Fork 0
mirror of https://github.com/neocities/neocities.git synced 2025-07-26 04:18:22 +02:00
Code Issues Projects Releases Packages Wiki Activity

password reset tweaks

Browse source
This commit is contained in:
Kyle Drake 2024-04-09 16:49:57 -05:00
parent 6ab3656040
commit 160dc9e2de
3 changed files with 33 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
app/password_reset.rb
View file

@ -13,21 +13,23 @@ post '/send_password_reset' do
sites = Site.get_recovery_sites_with_email params[:email]
if sites.length > 0
token = SecureRandom.uuid.gsub('-', '')
token = SecureRandom.uuid.gsub('-', '')+'-'+Time.now.to_i.to_s
sites.each do |site|
next unless site.parent?
site.password_reset_token = token
site.save_changes validate: false
body = <<-EOT
Hello! This is the Neocities cat, and I have received a password reset request for your e-mail address.
Hello! This is the Penelope the Neocities cat, and I have received a password reset request for your e-mail address.
Go to this URL to reset your password: https://neocities.org/password_reset_confirm?username=#{Rack::Utils.escape(site.username)}&token=#{token}
Go to this URL to reset your password: https://neocities.org/password_reset_confirm?username=#{Rack::Utils.escape(site.username)}&token=#{Rack::Utils.escape(token)}
This link will expire in 24 hours.
If you didn't request this password reset, you can ignore it. Or hide under a bed. Or take a nap. Your call.
Meow,
the Neocities Cat
Penelope
EOT
body.strip!
@ -61,7 +63,13 @@ get '/password_reset_confirm' do
redirect '/'
end
reset_site.password_reset_token = nil
timestamp = Time.at(reset_site.password_reset_token.split('-').last.to_i)
if Time.now.to_i - timestamp.to_i > Site::PASSWORD_RESET_EXPIRATION_TIME
flash[:error] = 'Token has expired.'
redirect '/'
end
reset_site.password_reset_confirmed = true
reset_site.save_changes