Juan Fernandez
e5b0f313f9
Reset tokens are base64url (case-sensitive) but the password_reset_requests.token column used case-insensitive utf8mb4_unicode_ci, so a case-mutated token copy still matched. Switch the column to utf8mb4_bin for byte-exact comparison.
2 lines
122 B
Plaintext
2 lines
122 B
Plaintext
- Fixed password reset so that case-mutated reset tokens are no longer accepted; tokens are now matched case-sensitively.
|