Fixed a bug when returning the password reset link, forgot to URL encode the token..

SecureCore/Controllers/AuthController.cs

@@ -89,6 +89,8 @@ namespace SecureCore.Controllers
         //[AcceptVerbs("GET")]
         public IActionResult ResetPassword([FromQuery] string token)
         {
+            if (!UserDataService.IsResetTokenValid(token)) return Unauthorized("Token invalid");
+
             return Ok("Done");
         }
 
@@ -105,7 +107,9 @@ namespace SecureCore.Controllers
             {
                 UserDataService.SetUserSessionToken(userName, token, DateTime.Now.AddHours(1), agent, ip, true);
 
-                return Ok($"192.168.255.200:5000/auth/ResetPassword?{token}{Environment.NewLine}");
+                token = HttpUtility.UrlEncode(token);
+
+                return Ok($"192.168.255.200:5000/auth/ResetPassword?token={token}{Environment.NewLine}");
             }
             catch(Exception e)
             {

SecureCore/Services/UserDataService.cs

@@ -160,6 +160,23 @@ namespace SecureCore.Services
             }
         }
 
+        public static bool IsResetTokenValid(string token)
+        {
+            using (var connection = new SqlConnection(ConnectionString))
+            {
+                using (var command = new SqlCommand("ValidateResetToken", connection) { CommandType = CommandType.StoredProcedure })
+                {
+                    command.Parameters.AddWithValue("SessionToken", token);
+
+                    connection.Open();
+
+                    var reader = command.ExecuteScalar();
+
+                    return Convert.ToBoolean(reader);
+                }
+            }
+        }
+
         //public static void ResetPassword(string email)
         //{
         //    using (var connection = new SqlConnection(ConnectionString))