[TikiWiki-commits] [Git][tikiwiki/tiki][master] [ENH] Validate username and activation code before showing the password reset form

ushindi bienvenu pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
7ece53c6 by Rodriguez Nyiringabo at 2026-08-28T22:47:07+00:00
[ENH] Validate username and activation code before showing the password reset form
---
* [ENH] Validate username and activation code before showing the password reset form

See merge request tikiwiki/tiki!10966

- - - - -


2 changed files:

- lib/userslib.php
- tiki-change_password.php


Changes:

=====================================
lib/userslib.php
=====================================
@@ -7526,6 +7526,14 @@ class UsersLib extends TikiLib
         return false;
     }
 
+    public function isValidActivationCode(string $user, string $actpass): bool
+    {
+        $query = 'select `provpass` from `users_users` where `login`=?';
+        $pass = $this->getOne($query, [$user]);
+
+        return ! empty($pass) && hash_equals(md5($pass), $actpass);
+    }
+
    /**
     * Tests the password against policy enforcement (Admin->Login), namely
     * $min_pass_length


=====================================
tiki-change_password.php
=====================================
@@ -35,6 +35,13 @@ if (empty($_REQUEST['user']) || ! $userlib->user_exists($_REQUEST['user'])) {
     Feedback::errorAndDie(tra('Invalid username'), \Laminas\Http\Response::STATUS_CODE_400);
 }
 
+if (! isset($_REQUEST['change']) && ! empty($_REQUEST['actpass']) && ! $userlib->isValidActivationCode($_REQUEST['user'], $_REQUEST['actpass'])) {
+    $smarty->assign('msg', tra('Invalid username or activation code. Maybe this code has already been used.'));
+    $smarty->assign('errortype', 'no_redirect_login');
+    $smarty->display('error.tpl');
+    die;
+}
+
 if (! isset($_REQUEST["oldpass"])) {
     $_REQUEST["oldpass"] = '';
 }



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/7ece53c654195133e6233db9ecc28ee9a882cbc3

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/7ece53c654195133e6233db9ecc28ee9a882cbc3
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs