Skip to content

feature(securité): Fournir un lien pour mettre à jour le mot de passe - #2430

Merged
vgreb merged 2 commits into
afup:masterfrom
vgreb:security/token-reset-password
Oct 24, 2026
Merged

vgreb merged 2 commits into
afup:masterfrom
vgreb:security/token-reset-password

Conversation

@vgreb

@vgreb vgreb commented Oct 12, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

->table('afup_password_reset_tokens', ['id' => false, 'primary_key' => ['user_id']])
->addColumn('user_id', 'integer', ['signed' => false, 'null' => false])
// SHA-256 du jeton : le jeton en clair n'existe que dans l'e-mail.
->addColumn('token_hash', 'string', ['limit' => 64, 'null' => false])

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion : utiliser le terme token tout simplement.

{
$plainToken = bin2hex(random_bytes(32));
$now = $this->clock->now();

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion : Peut être jouer une requête SQL avant pour nettoyer cette table, non ?

DELETE ... WHERE expires_at < NOW()

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah oui, je n'y ai pas pensé. Je rajoute ça

vgreb added 2 commits October 15, 2026 23:07
…pirés

- Remplace « jeton » par « token » dans les commentaires.
- Supprime les tokens expirés à chaque nouvelle demande de réinitialisation.
@vgreb
vgreb force-pushed the security/token-reset-password branch from c0beda8 to 690e426 Compare October 15, 2026 21:07
@vgreb
vgreb merged commit 26c94a7 into afup:master Oct 24, 2026
13 of 14 checks passed
@vgreb
vgreb deleted the security/token-reset-password branch October 24, 2026 18:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants