Fixed a bug when returning the password reset link, forgot to URL encode the token..

2021-01-08 10:52:10 -06:00
parent d495bfca9c
commit c2297ed368
3 changed files with 22 additions and 1 deletions
@@ -89,6 +89,8 @@ namespace SecureCore.Controllers
        //[AcceptVerbs("GET")]
        public IActionResult ResetPassword([FromQuery] string token)
        {
+            if (!UserDataService.IsResetTokenValid(token)) return Unauthorized("Token invalid");
+
            return Ok("Done");
        }

@@ -105,7 +107,9 @@ namespace SecureCore.Controllers
            {
                UserDataService.SetUserSessionToken(userName, token, DateTime.Now.AddHours(1), agent, ip, true);

-                return Ok($"192.168.255.200:5000/auth/ResetPassword?{token}{Environment.NewLine}");
+                token = HttpUtility.UrlEncode(token);
+
+                return Ok($"192.168.255.200:5000/auth/ResetPassword?token={token}{Environment.NewLine}");
            }
            catch(Exception e)
            {