src/Module/Authentication/LocalAuth/PasswordReset.php
protected function checkResetLink()
    {
        // Check if the reset links are enabled, if token is present,
        // if it has a valid format and length
        if (!$this->config["enabled"]
            || !($token = $this->httpRequest->query->get("confirm", false))
            || !preg_match("/^[a-f0-9]+$/", $token)
            || strlen($token) !== 2*($this->config["tokenIdLen"]+$this->config["tokenLen"])) {
            return;
        }

        // Delete the active password reset session, if set
        $this->session->remove("pwreset");
        
        // Split token parts
        $tokenId = substr($token, 0, 2 * $this->config["tokenIdLen"]);
        $verifier = substr($token, 2 * $this->config["tokenIdLen"]);

        // Validate token timeout
        $tokenData = $this->storage->getResetToken($tokenId);

        // Token not found or expired
        if (!$tokenData || time() > $tokenData['valid']) {
            $this->session->addFlash("error", "Reset link has expired.");
            $this->getLogger()->warning("Bad reset token {t} from {addr}", [$token, $_SERVER['REMOTE_ADDR']]);
            $this->picoAuth->redirectToPage("password_reset");
        }

        if (hash_equals($tokenData['token'], hash('sha256', $verifier))) {
            $this->session->addFlash("success", "Please set a new password.");
            $this->startPasswordResetSession($tokenData['user']);
            $this->logResetLinkVisit($tokenData);
            $this->picoAuth->redirectToPage("password_reset");
        }
    }
protected function checkResetLink()
    {
        // Check if the reset links are enabled, if token is present,
        // if it has a valid format and length
        if (!$this->config["enabled"]
            || !($token = $this->httpRequest->query->get("confirm", false))
            || !preg_match("/^[a-f0-9]+$/", $token)
            || strlen($token) !== 2*($this->config["tokenIdLen"]+$this->config["tokenLen"])) {
            return;
        }

        // Delete the active password reset session, if set
        $this->session->remove("pwreset");
        
        // Split token parts
        $tokenId = substr($token, 0, 2 * $this->config["tokenIdLen"]);
        $verifier = substr($token, 2 * $this->config["tokenIdLen"]);

        // Validate token timeout
        $tokenData = $this->storage->getResetToken($tokenId);

        // Token not found or expired
        if (!$tokenData || time() > $tokenData['valid']) {
            $this->session->addFlash("error", "Reset link has expired.");
            $this->getLogger()->warning("Bad reset token {t} from {addr}", [$token, $_SERVER['REMOTE_ADDR']]);
            $this->picoAuth->redirectToPage("password_reset");
        }

        if (hash_equals($tokenData['token'], hash('sha256', $verifier))) {
            $this->session->addFlash("success", "Please set a new password.");
            $this->startPasswordResetSession($tokenData['user']);
            $this->logResetLinkVisit($tokenData);
            $this->picoAuth->redirectToPage("password_reset");
        }
    }
protected function checkResetLink ( ) { // Check if the reset links are enabled, if token is present, // if it has a valid format and length if ( ! $ this -> config [ "enabled" ] || ! ( $ token = $ this -> httpRequest -> query -> get ( "confirm" , false ) ) || ! preg_match ( "/^[a-f0-9]+$/" , $ token ) || strlen ( $ token ) !== 2 * ( $ this -> config [ "tokenIdLen" ] + $ this -> config [ "tokenLen" ] ) ) { return ; } // Delete the active password reset session, if set $ this -> session -> remove ( "pwreset" ) ; // Split token parts $ tokenId = substr ( $ token , 0 , 2 * $ this -> config [ "tokenIdLen" ] ) ; $ verifier = substr ( $ token , 2 * $ this -> config [ "tokenIdLen" ] ) ; // Validate token timeout $ tokenData = $ this -> storage -> getResetToken ( $ tokenId ) ; // Token not found or expired if ( ! $ tokenData || time ( ) > $ tokenData [ 'valid' ] ) { $ this -> session -> addFlash ( "error" , "Reset link has expired." ) ; $ this -> getLogger ( ) -> warning ( "Bad reset token {t} from {addr}" , [ $ token , $ _SERVER [ 'REMOTE_ADDR' ] ] ) ; $ this -> picoAuth -> redirectToPage ( "password_reset" ) ; } if ( hash_equals ( $ tokenData [ 'token' ] , hash ( 'sha256' , $ verifier ) ) ) { $ this -> session -> addFlash ( "success" , "Please set a new password." ) ; $ this -> startPasswordResetSession ( $ tokenData [ 'user' ] ) ; $ this -> logResetLinkVisit ( $ tokenData ) ; $ this -> picoAuth -> redirectToPage ( "password_reset" ) ; } }
Validates a password reset link

If a valid password reset link was provided, starts a password reset
session and redirects to a password change form

@return void
Validates a password reset link