As an hardening measure we should expire password reset tokens after 12h and if the user has logged-in again successfully after the token was requested.
This patch wil warn the user of the consequences when resetting the password and requires checking a checkbox (as we had in the past) to reset a password.
Furthermore I updated the code to use our new classes and added some unit tests for it 👯
Fixes https://github.com/owncloud/core/issues/11438
Lukas Reschke
Joas Schilling