vocdoni / saas-backend / 28366731294

63%

Build Type

push

github

Committed by web-flow

Commit Message

fix(api): reject password reset on wrong code (#527.1) (#528)

* fix(api): reject password reset on wrong code and invalidate used codes

resetUserPasswordHandler wrote ErrUnauthorized on a reset-code mismatch
but did not return, so execution fell through and stored the
attacker-supplied password. This allowed account takeover for any
account with a live password-reset record.

- return immediately after the code mismatch error
- delete the reset code after a successful reset so it cannot be reused
- add DeleteUserVerificationCode DB helper
- add regression test covering wrong code, reused code and success paths

Refs #527 (1)

Coverage Stats

10 of 13 new or added lines in 2 files covered. (76.92%)

1 existing line in 1 file now uncovered.

10090 of 16141 relevant lines covered (62.51%)

45.06 hits per line