From 7613801a58fb25135a6b925995b659b9233e149a Mon Sep 17 00:00:00 2001 From: Morris Jobke Date: Fri, 31 Aug 2018 09:26:09 +0200 Subject: [PATCH] Change password expiration time from 12h to 7d We use the same logic for creating accounts without a password and there the 12h is a bit short. Users don't expect that the signup link needs to be clicked within 12h - 7d should be a more expected behavior. Signed-off-by: Morris Jobke --- core/Controller/LostController.php | 2 +- tests/Core/Controller/LostControllerTest.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/core/Controller/LostController.php b/core/Controller/LostController.php index ce98426084..d30c6ae1eb 100644 --- a/core/Controller/LostController.php +++ b/core/Controller/LostController.php @@ -187,7 +187,7 @@ class LostController extends Controller { throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); } - if ($splittedToken[0] < ($this->timeFactory->getTime() - 60*60*12) || + if ($splittedToken[0] < ($this->timeFactory->getTime() - 60*60*24*7) || $user->getLastLogin() > $splittedToken[0]) { throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is expired')); } diff --git a/tests/Core/Controller/LostControllerTest.php b/tests/Core/Controller/LostControllerTest.php index 61bdb21918..d372ec559d 100644 --- a/tests/Core/Controller/LostControllerTest.php +++ b/tests/Core/Controller/LostControllerTest.php @@ -584,7 +584,7 @@ class LostControllerTest extends \Test\TestCase { ->with('ValidTokenUser') ->willReturn($this->existingUser); $this->timeFactory->method('getTime') - ->willReturn(55546); + ->willReturn(617146); $this->crypto->method('decrypt') ->with(