[cgi name=lost_email filter=e hide=1]
[perl tables=userdb]
unless (delete $Scratch->{real_password_attempt} ) {
return "Must come from form.";
}
if( $Scratch->{tried_pw_retrieve}++ > 10 ) {
return "No way, José. Too many times.";
}
my $uid = $Db{userdb}->foreign($CGI->{lost_email}, 'usernick');
$Tag->tmp('found_user', $uid) if $uid;
return;
[/perl]
[if scratch found_user]
[set id_ok][/set]
[tmp id_ok][email
to="[cgi lost_email]"
subject="__COMPANY__ password reset"
from="__COMPANY__ <__EMAIL_SERVICE__>"][perl table=userdb]
$Tag->tmp('hmac');
$Tag->tmp('expires');
my $db = $Db{userdb};
my $uid = $Scratch->{found_user};
my $key = $Variable->{PASSWORD_RESET_CHECK_KEY};
my $expires = $Scratch->{expires} = $Tag->time({ body => '%y%m%d%H', adjust => '1 days', });
my ($email, $pw, $mod_time, $expiry) = $db->get_slice($uid, [qw/email password mod_time expiration/]);
# using mod_time+expiry in hmac prevents clicking link again after pw_reset page loads
my $hmac = $Tag->filter({ op => "hmac_sha1_hex.$key", body => $mod_time . $expiry . $expires . $email });
$Scratch->{hmac} = substr($hmac, 0, 20); # cropping to fit in email; should be ok
return;
[/perl]Someone (maybe you) asked to reset the password for this member:
Email: [cgi lost_email]
To reset your password visit the following address; otherwise ignore
this email and nothing will happen.
[area href=query/pw_reset secure="__SECURE_ENABLE__" no_session=1 form="
u=[scratch found_user]
x=[scratch expires]
k=[scratch hmac]
"]
Thank you,
__COMPANY__
[/email][/tmp]
[if !scratch id_ok]
Something went wrong when mailing, perhaps a typo in your email address? Please
either
create a new account or
contact us..
[else]
We have sent an email to the address on file. Please click the link in this email to reset your password.
If you do not receive the email, please contact us. Be aware that it could take several minutes for the email to arrive.
[/else]
[/if]
[else]
Sorry, no user found. Try again?
[/else]
[/if]