Allow multiple calls of the link to set a new password

See #2923

diff --git a/wcfsetup/install/files/lib/form/NewPasswordForm.class.php b/wcfsetup/install/files/lib/form/NewPasswordForm.class.php
index 27e4e1694b50b3fc815354c0c2b2a2d9815c4f57..c6a7a85c2e1bf019b1cbf9c96438d7076b7144dc 100644 (file)
--- a/wcfsetup/install/files/lib/form/NewPasswordForm.class.php
+++ b/wcfsetup/install/files/lib/form/NewPasswordForm.class.php
@@ -2,7 +2,6 @@
 namespace wcf\form;
 use wcf\data\user\User;
 use wcf\data\user\UserAction;
-use wcf\data\user\UserEditor;
 use wcf\system\exception\IllegalLinkException;
 use wcf\system\exception\NamedUserException;
 use wcf\system\exception\PermissionDeniedException;
@@ -79,18 +78,20 @@ class NewPasswordForm extends AbstractForm {
                                $this->throwInvalidLinkException();
                        }
                        
-                       (new UserEditor($this->user))->update([
-                               'lastLostPasswordRequestTime' => 0,
-                               'lostPasswordKey' => null
+                       WCF::getSession()->register('lostPasswordRequest', [
+                               'userID' => $this->user->userID,
+                               'key' => $this->user->lostPasswordKey
                        ]);
-                       WCF::getSession()->register('lostPasswordRequest', $this->user->userID);
                }
                else {
-                       if (!WCF::getSession()->getVar('lostPasswordRequest')) throw new PermissionDeniedException();
-                       $this->userID = intval(WCF::getSession()->getVar('lostPasswordRequest'));
+                       if (!is_array(WCF::getSession()->getVar('lostPasswordRequest'))) throw new PermissionDeniedException();
+                       $this->userID = intval(WCF::getSession()->getVar('lostPasswordRequest')['userID']);
                        
                        $this->user = new User($this->userID);
                        if (!$this->user->userID) throw new IllegalLinkException();
+                       if (!\hash_equals($this->user->lostPasswordKey, WCF::getSession()->getVar('lostPasswordRequest')['key'])) {
+                               $this->throwInvalidLinkException();
+                       }
                }
        }