From c2297ed36825fe72c8650664e19976e494318f77 Mon Sep 17 00:00:00 2001
From: Garrritt McCune <glmccune@gmail.com>
Date: Fri, 8 Jan 2021 10:52:10 -0600
Subject: [PATCH] Fixed a bug when returning the password reset link, forgot to
 URL encode the token..

---
 .vs/SecureCore/v16/.suo                  | Bin 67584 -> 67584 bytes
 SecureCore/Controllers/AuthController.cs |   6 +++++-
 SecureCore/Services/UserDataService.cs   |  17 +++++++++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/.vs/SecureCore/v16/.suo b/.vs/SecureCore/v16/.suo
index 5a982d62a41f0aa78a5d63866c2c7f137f76a96f..d785088e1fa74d3a1251c392b5633ad8c0ae1dc3 100644
GIT binary patch
delta 2457
zcmZpez|t^*WrD%vf<#UU0R{$11_lOZ1_p+I|NsAIU|?WiWME(@*cd3y#P^|(RrTJ}
zYm62Q3=9s=ldG7jn0Oc`e`Bg+w4YqcTyL7nz`)SL2hzj9z{bG9@b^Cg<S{TXC^IlH
zs4y@vfJ99g7#NHh7#NHu21-wMVUd}{!&1)zl>^ChF)%PlFfcHbF)%QcBZ-6L)EO8U
zWEdD2%%S2OP+AU3gVd-pFff!bFfgzpiD@!0Fz7KbFqkqhFz7HaFbFa*FmN(3Fqkng
zFjz7$On%IA(W4ORbCB;r?k|Sw*JWT}C}m(^Fl1n0kY`|Es9<1VsAOPZsA6DXsD-Kl
z*;~iJz#z-Oz%cm_V<E=}4d1&@uQ6(GE@hj|SPznhVUY14wlq|$FaraF2m=Fy0s{ks
z6axc;00RR9JJczl5EW%$U=U(pVBlq7U=U|uU{GUVU}%8qRb*gb(15Z*L6*V5z>vwn
zz#zuJz`zal;{X5u)j;-vu@Y1<$p4@)1Nl=QDwZ~RD@Qe_F9QRE9|HqJ^khp;b;(Eu
z28Jl8V`3N>7-AV17~&Wh7<4BF%5$c}0%h_-PW8zNEG!d46hvwm7#QlICW5R4g~%qJ
zH;f{GK*<7R6i5=3QWzN+Hu04(GI26aF5|D`Nn&7N03`#E)Fh!2#+1pWLiLQvlfMep
zGsaFX74BZd#k5IGg=w>j$Q{N>a$gwjCVw@lXSAJMYFf``1J=CxmpB{OCLWL)l{<`^
zJe-*}JF9JFWGtEdQ@xtee{-ouH~S(Zrb!A%6pf&X5R@1}i2{@mK#2;Jz%3aV7_25A
zR1ly1M?po<lYxQ3i-Cc`n}LDBhk=2?cd{X;uq`MSK{$kgfgzNEfgy~6fgzlMfgyr{
zfdLk1(F_a>pg;qu1L1fE28IL%28P7R2Ni@TPf^TSWWcm3>jdNE6Xq6+l$aLTur0D+
zTI9qs$*Y7hZgQ#Ge@5%crRvR0lUO$Y@~&cJ44z!7S<fBBz`(!+3M2-G&HqywnHIS*
zEec?oB%-oe#qSQ|q7WwD7ElO-!XAXTGcqxLX5>#vO-n4zDTy!1EpRfkG~3J{^pSB<
z9Mhs0rbSUqi^5nIr7&&E;O1d5b}=#8%pc^*$Yp!2NA}#R57)MIP7VuJ+uTulfrAxf
zFaKo6dg)1tER$>MI9TR@(tG2TjLCJ^`6gEwsqix}^g+`zh&G-4F+q5;N4*5&tjUS>
zl9Is;sSHI7Wek}N$qcCs#SD53p$x?!vB`y3C4)T~iWxvEiW!O-G8yt2@)$xG@)@!j
zQW^3X!Wa@6au_lhQW!KCiWy26iWo8(@)*(?6u|ni=>TPUp2>_2m5fL(-oa=Ea?)mx
zdSk}PMXgFaxeWOXDGaF$ISj>&lNFgnSc@1^8G0rMG^w#Xc=!MR<f<lX#^Onh@{?nX
zI3}kzOHOuZG~_p8Fk~=eum(FenW1!ZL*o*b$xZE2%z6wAlN-D2H#f97FfK}9ntZ9v
zVDpEWY>eCm4EYSj3^5GB42+W<x7ts3=x&(Qb9S=K<YSZ1_T+A=X<?#jP)5)oD8Wf?
z@|txaoBQVWF>Zb|S&nHkTSEyeKd7RBrHO_*4M?~>Y!sP%piW~_qsZiYmvtsPG#X7d
zU}Bq`P|pDlEm>!Vd<IZZ&tgnwuwsZ|C<Vu35jc<-CNs9!Z*G`T#>8#PV8UR;V8&p?
zz&QC}oBd{o*_%YfKm{+@H4G{T)<IL7%cjW>m(@<5u*hul?hUh;Btf|qqDJXJF0`QM
z0ab6HNS@qqyKd4Jm&p^lv?lAd39(0<2h}+YlTWr;PCl?jL)?iWharW5fx#AB8!|9h
zGl1kBH~-(l$i8XOCtf~O7feocke@tZAJ=BhJ=d8Ry<+2l6zFJ9Qt*Jdhk=1X=>Vvx
z0F}jHCqcz0UtBIfS#yu{<n`;F(QP=;?ErFcg0T(UvB$ST99s$wM_72qFeEY*FcdHp
zPyWB9k#W*wMk9M&Mn(n(Hbw>pW<~}E7DfgJRz^q_&(6rezyW1*F)}c4gV><*;xZ$+
zAf9}r+h)?wt<nr2D?k}GhCy!UC;ejIv&q$M;!Vug(pOEsutj2W({_nTTN@yjae~U6
zCI$wE{EdO@87CHaOxkf^a>M3^$qqXYEV{xpY1e^8+ZZ<=*nNO;()I(B3%0OLP7f8D
zd}D{kWWi-plRqq1+`RimE8}D(+q}u|b_Gp3?=<;Joy6p*-D;B?&L5bZbSZ9ffDsG0
zwArxt!sL624U;Z8Og?bVVe-5r3l2z~-@z~$R3bgtEU<aU1rNr_4Ob3Kp7dR0bI2tf
zrpX4E<=`e1ToquP0SckXldg+x7W?#yd9u)UwaEuA$xQxmk!|vyYeJKwo~2E0xY{t;
z;rRiOqRC>{R&74;&4F>#w<AoGKRvTzESmiP$2MtjQI^aAYB6Ahkib^M$&5ejCts?Q
lLNfZu<O9zdCL8<^m@M#Z!{UZNjFUIj1x>cI(_#TNpa6SVB`5#@

delta 1729
zcmZpez|t^*WrBes69W_oFfi~lFfcGPFfjc4|NlQo6vS@Y7%0ueX>h;GqWS4HM$65m
zY~75S91IK$fBz!@NCOK41A__!0|Q7@m4Si5gn@y<bYh_NWEl>Q$v!M1_0<dv48~9e
zAVsVU3=9$s3=Aa<3=E}6;vhLm1_lOo1_lOYs5lptmV?qDHEawF4228~3`R&|nhXpK
z77PpwIt&a9W(*7rdJGH<f(#4{oD2+14Ca#`vRrn|V_;y&XJB9`U|?X-Wnf?^hH5ut
zU|^7EU|=X?U|=X`U|^_VU|^_ZU|^_XU|^7CU|^_)s{1$jD`Pq5g#5p0pa9X>T*@|^
zu^tovAUA<9C?G(z6jXx{0|SFF0|SFJ0|SFN0|Ns)0|NseG?Yac7#IW?7#MgN7#PGD
z7#Nfo7#I{77#QlHdes;h7(}6LP*|lgFfgPuFfedK{KTLLky8WN2gV@Jf*4v13=E*a
z(q>>_(1$4cA3J#~M>S*QWJ5*i$v&JSk|0M%F)%PhGcYj3Ktm&rfq}trVxT-HC@3-*
z7#K1qFXU8bteF_7E&vJzkRDh_ED~UvoWR1enMFx~X|syN9mYjUOpBzLCIzW%RuQ?w
zxJgI_EX=t`4I-v;hjEj}4@SnS$v-u#8GSdGYIU<OGGkg~#I#AynQ^i+v*F|t`GCns
z#0^+M>4atTPjhyrNm)lWA91o_oP0z<WV49E8^%R8Y>Ql278NjUQgddS?CfE<xkRId
zk*SJl^DoaT#>pkxJ&S^v76mZzr=+GOmgbbim*f^$8d|t+=8yQuxG02aQ3A`NIHpB0
zOpBtJ7FDn;N?}^$!?Y=ln}@~B(8w9AYEwxB$K;3!I+N$rZD5p}Y*?$kxuRa0ku8Ry
zh#{46vLchn<f0Y@{#=H9h7^WWh8%|C2k-v>pRBlBbh2c#`ecVj`N^vrxF+9k5@Rf$
z>@eMkubd&Dp@<=yp_sv%!H!|`fyN~)lT*567#SuvcG+)knA5;GX+jIaw#gOs3nn{s
zedA_eux0=yeMbhy$&5SgH#^Kfz{JQh`FCw4I|KC`)4;T75zA(W78NEGN0l*Qv44|@
zm?fxa0AsBKVbDD0vT5?eRkf2REHm4@d&?{)1skwDh)@En0kL?Xr3;8XxpZguq#Z7k
zKkc$%k2nwVBE#g1R~09(*d;Ofzz&VcPAw9PcCv4J)xfy9;d}$rre&Xac~R`0EVx^J
z@_}non;kA4V4d{6VROT?2FA$~c1diO`0;{~1CsO6TqW%avKow)4n#08Fn~%KsH-Ob
zS)nv}%GNyM95uP&e8Xg+-D;B$T$7pn;VRqYKR<*vNBvsHIN4~Y#b%2OC)m-Q#Jq*^
z2-9Q(I|~*D1~!Jt4iC0U+vJtz<k&G7XOxu4?fj%)?0Yu3x=p-^`C9s_$rm1|awEwv
zVPq1(qDBo=q=5ayz)+#97UKS4vfIiTiVsu-t^To1o+zxpyn&685mV<xVg1PqgcU$|
z`hP~oqa?YD2gzOkHZuzRXJq_4*^xzlvqIPdEOuRZKm}KFfol~|x%PLnVAy-ci3J=0
DDhgK;

diff --git a/SecureCore/Controllers/AuthController.cs b/SecureCore/Controllers/AuthController.cs
index 44cb7c7..478974c 100644
--- a/SecureCore/Controllers/AuthController.cs
+++ b/SecureCore/Controllers/AuthController.cs
@@ -89,6 +89,8 @@ namespace SecureCore.Controllers
         //[AcceptVerbs("GET")]
         public IActionResult ResetPassword([FromQuery] string token)
         {
+            if (!UserDataService.IsResetTokenValid(token)) return Unauthorized("Token invalid");
+
             return Ok("Done");
         }
 
@@ -105,7 +107,9 @@ namespace SecureCore.Controllers
             {
                 UserDataService.SetUserSessionToken(userName, token, DateTime.Now.AddHours(1), agent, ip, true);
 
-                return Ok($"192.168.255.200:5000/auth/ResetPassword?{token}{Environment.NewLine}");
+                token = HttpUtility.UrlEncode(token);
+
+                return Ok($"192.168.255.200:5000/auth/ResetPassword?token={token}{Environment.NewLine}");
             }
             catch(Exception e)
             {
diff --git a/SecureCore/Services/UserDataService.cs b/SecureCore/Services/UserDataService.cs
index f2f37a7..8e15c01 100644
--- a/SecureCore/Services/UserDataService.cs
+++ b/SecureCore/Services/UserDataService.cs
@@ -160,6 +160,23 @@ namespace SecureCore.Services
             }
         }
 
+        public static bool IsResetTokenValid(string token)
+        {
+            using (var connection = new SqlConnection(ConnectionString))
+            {
+                using (var command = new SqlCommand("ValidateResetToken", connection) { CommandType = CommandType.StoredProcedure })
+                {
+                    command.Parameters.AddWithValue("SessionToken", token);
+
+                    connection.Open();
+
+                    var reader = command.ExecuteScalar();
+
+                    return Convert.ToBoolean(reader);
+                }
+            }
+        }
+
         //public static void ResetPassword(string email)
         //{
         //    using (var connection = new SqlConnection(ConnectionString))