Thanakorn
73c680e844
- OTP attempt limits, constant-time compare, random reference codes - DB-backed rate limits (429) on sign-in, OTP, reset, register, onboarding - one generic sign-in failure message; reset request no longer reveals accounts - no password kept in the session; real status codes on failures
17 lines
748 B
PHP
17 lines
748 B
PHP
<?php
|
|
// Profile page "Forgot your current password?" — signed-in users only.
|
|
// (This used to declare UNAUTHENTICATED_ROUTE, which let anonymous callers in
|
|
// with no $user_id; the login page has its own endpoint in login/api/engine/.)
|
|
require_once __DIR__ . '/../../../session.php';
|
|
require_once '../../../assets/utils/db_auth.php';
|
|
require_once '../../../assets/utils/rate_limit.php';
|
|
require_once '../../../assets/utils/classes/PasswordResetManager.php';
|
|
|
|
// Every hit sends an email.
|
|
rate_limit_guard($pdo1, [
|
|
['reset_req_user', (string)$user_id, 3, 900],
|
|
]);
|
|
|
|
$prm = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
|
|
$prm->handleRequestOtp($user_id, $company_id);
|