php - What stops someone from forging a password reset link? -


i'm creating profile system website, , i'm @ point i'm coding password reset function in php.

basically, i'm asking user email address, setting random md5 password , emailing them , comes in link formatted like

www.mysite.com/reset.php?email=myemail@myemail.com&hash=hashgoeshere

what point in hiding passwords behind md5 when forge password reset link , use hash value instead of password?

you should opt workflow like:

  • generate new guid, save against user account, call passwordresettoken
  • the email send should redirect user /reset.php?email=myemail@email.com&resettoken=xxxxxxxxxxx
  • you verify reset token exists user account specified
  • ask user enter new password of choice , save it.
  • nullify saved reset token cannot used again

it extremely/statistically unlikely guess link set someone's password chose, unless (a) reset request made account, , (b) can happen guess guid generated.


Comments

Post a Comment

Popular posts from this blog

Magento/PHP - Get phones on all members in a customer group -

i working on custom magento extension. working around adminhtml part , i've created custom form there. here form code: <?php class vivasindustries_smsnotification_block_adminhtml_sms_sendmass_edit_form extends mage_adminhtml_block_widget_form { public function _preparelayout() { $extensionpath = mage::getmoduledir('js', 'vivasindustries_smsnotification'); $head = $this->getlayout()->getblock('head'); $head->addjs('jquery.js'); $head->addjs('vivas.js'); return parent::_preparelayout(); } protected function _prepareform() { $form = new varien_data_form(array( 'id' => 'edit_form', 'action' => $this->geturl('*/*/save', array('id' => $this->getrequest()->get
Read more

php - .htaccess mod_rewrite for dynamic url which has domain names -

i want convert url ex:( example.com/link.php?url=facebook.com ) ( example.com/facebook.com.php ) how can using .htaccess. or there other process make job easier ? i tried adding script .htaccess file options +followsymlinks rewriteengine on rewriterule url-(.*)\.htm$ link.php?url=$1 but converting url adding "url-" ( example.com/url-facebook.com.php ) i want remove "url-" , want make ( example.com/facebook.com.php ) rewriteengine on rewritecond %{the_request} ^get.*link\.php\?url\= [nc] rewritecond %{request_uri} !/system/.* [nc] rewriterule (.*?)link\.php\?url\=/*(.*) /$1$2 [r=301,ne,l] not sure how above work edit of used use remove index.php url
Read more

Website Login Issue developed in magento -

i have website developed using magento . able login. right now, login failed. infact operations interacts user table failing. need know issue. how figure out? first clear try clear log file second make sure have not upgraded magento and 3rd make sure db accessible in magento -harry p
Read more