diff --git a/oc-includes/osclass/UserActions.php b/oc-includes/osclass/UserActions.php index 6edd5f7d41..3890b62954 100755 --- a/oc-includes/osclass/UserActions.php +++ b/oc-includes/osclass/UserActions.php @@ -239,8 +239,15 @@ function recover_password() return 1; } - $code = osc_genRandomPassword(30); $date = date('Y-m-d H:i:s'); + $pass_date = $user['s_pass_date']; + + if( !empty($user['s_pass_code']) && ((strtotime($date) - strtotime($pass_date)) < 60*60*24) ) { + return 3; + } + + $code = osc_genRandomPassword(30); + User::newInstance()->update( array('s_pass_code' => $code, 's_pass_date' => $date, 's_pass_ip' => Params::getServerParam('REMOTE_ADDR')), array('pk_i_id' => $user['pk_i_id']) diff --git a/oc-includes/osclass/controller/login.php b/oc-includes/osclass/controller/login.php index 2c2abbbbcf..57305f3056 100755 --- a/oc-includes/osclass/controller/login.php +++ b/oc-includes/osclass/controller/login.php @@ -224,6 +224,10 @@ function doModel() osc_add_flash_error_message( _m('The recaptcha code is wrong')); $this->redirectTo( osc_recover_user_password_url() ); break; + case(3): // prevent multiple requests in 24 hours interval + osc_add_flash_error_message( _m('You have already requested a password reset. Please wait 24 hours to make another one.')); + $this->redirectTo( osc_user_login_url() ); + break; } break; case('forgot'): //form to recover the password (in this case we have the form in /gui/)