KircheNeuenburg / ldaporg

Manage your LDAP users and groups directly in Nextcloud
GNU Affero General Public License v3.0
14 stars 5 forks source link

Replacement for sending passwort reset link mail #14

Closed ghost closed 7 years ago

ghost commented 7 years ago

We spotted an issue in the registration process using the method to send a password reset link that is currently implemented.

If the user reads the mail not immediately, but a day or two after the mail was sent, the token in the reset link of self-service-password is invalid (this is a security feature).

I found out that calling the self-service-password url and appending the login (in our case mailadress) as an argument via http-get works quite well. The user clicks the link in his welcome mail and triggers the reset link on his own.

Therefore I suggest we introduce a tag in our mail text that is auomatically replaced by the url and the appended mail adress of the user.

(If you trust me, I may implement the feature in a separate branch by myself)