(cp 34296598d) fixes #2281 add two default conf for reset and activation link

When a password activation or reset link is generated, the link expiry time is now defined in two conf: $conf[’password_reset_duration‘] with a default time of one hour and $conf[’password_activation_duration‘] with a default time of 72 hours.

include/config_default.inc.php

@@ -599,6 +599,14 @@ $conf['browser_language'] = true;
 // If false it'll be redirected from index.php to identification.php
 $conf['guest_access'] = true;
 
+// password_reset_duration : defines the validity duration (in seconds) of a 
+// password reset link. Default value is one hour (3600 seconds).
+$conf['password_reset_duration'] = 60*60;
+
+// password_activation_duration : defines the validity duration (in seconds) 
+// of an password activation link. Default value is 72 hours (259200 seconds).
+$conf['password_activation_duration'] = 3*24*60*60;
+
 // +-----------------------------------------------------------------------+
 // |                               history                                 |
 // +-----------------------------------------------------------------------+

include/functions_mail.inc.php

@@ -1010,11 +1010,12 @@ function pwg_send_mail_test($success, $mail, $args)
  * Return the content mail to send
  * @since 15
  * @param string $username
- * @param string $reset_password_link
+ * @param string $password_link
  * @param string $gallery_title
- * @return string mail content
+ * @param string $remaining_time
+ * @return array mail content
  */
-function pwg_generate_reset_password_mail($username, $reset_password_link, $gallery_title)
+function pwg_generate_reset_password_mail($username, $password_link, $gallery_title, $remaining_time)
 {
   set_make_full_url();
   
@@ -1026,7 +1027,8 @@ function pwg_generate_reset_password_mail($username, $reset_password_link, $gall
     );
   $message.= "\r\n\r\n";
   $message.= l10n('To reset your password, visit the following address:') . "\r\n";
-  $message.= $reset_password_link;
+  $message.= $password_link . "\r\n";
+  $message.= l10n('This link is valid for %s. After this time, you will need to request a new link.', $remaining_time);
   $message.= "\r\n\r\n";
   $message.= l10n('If this was a mistake, just ignore this email and nothing will happen.')."\r\n";
 
@@ -1047,11 +1049,12 @@ function pwg_generate_reset_password_mail($username, $reset_password_link, $gall
  * Return the content mail to send
  * @since 15
  * @param string $username
- * @param string $reset_password_link
+ * @param string $password_link
  * @param string $gallery_title
- * @return string mail content
+ * @param string $remaining_time
+ * @return array mail content
  */
-function pwg_generate_set_password_mail($username, $set_password_link, $gallery_title)
+function pwg_generate_set_password_mail($username, $set_password_link, $gallery_title, $remaining_time)
 {
   set_make_full_url();
   
@@ -1063,7 +1066,8 @@ function pwg_generate_set_password_mail($username, $set_password_link, $gallery_
     );
   $message.= "\r\n\r\n";
   $message.= l10n('To set your password, visit the following address:') . "\r\n";
-  $message.= $set_password_link;
+  $message.= $set_password_link . "\r\n";
+  $message.= l10n('This link is valid for %s. After this time, you will need to request a new link.', $remaining_time);
   $message.= "\r\n\r\n";
   $message.= l10n('If this was a mistake, just ignore this email and nothing will happen.')."\r\n";
 

include/functions_user.inc.php

@@ -1740,14 +1740,19 @@ function deactivate_password_reset_key($user_id)
  *
  * @since 15
  * @param int $user_id
- * @param string $user_email
- * @return array activation_key and reset password link 
+ * @param boolean $first_login
+ * @return array time_validation and password link 
  */
-function generate_reset_password_link($user_id)
+function generate_password_link($user_id, $first_login=false)
 {
+  global $conf;
+
   $activation_key = generate_key(20);
 
-  list($expire) = pwg_db_fetch_row(pwg_query('SELECT ADDDATE(NOW(), INTERVAL 1 HOUR)'));
+  $duration = $first_login
+  ? $conf['password_activation_duration'] 
+  : $conf['password_reset_duration'];
+  list($expire) = pwg_db_fetch_row(pwg_query('SELECT ADDDATE(NOW(), INTERVAL '. $duration .' SECOND)'));
 
   single_update(
     USER_INFOS_TABLE,
@@ -1760,13 +1765,20 @@ function generate_reset_password_link($user_id)
 
     set_make_full_url();
 
-    $reset_password_link = get_root_url().'password.php?key='.$activation_key;
+    $password_link = get_root_url().'password.php?key='.$activation_key;
 
     unset_make_full_url();
 
+    $time_validation = time_since(
+      strtotime('now -'.$duration.' second'),
+      'second',
+      null,
+      false
+    );
+
     return array(
-      'activation_key' => $activation_key,
-      'reset_password_link' => $reset_password_link,
+      'time_validation' => $time_validation,
+      'password_link' => $password_link,
     );
 }
 

include/ws_functions/pwg.users.php

@@ -989,7 +989,7 @@ SELECT
  *    @option string pwg_token
  *    @option boolean send_by_mail
  */
-function ws_users_generate_reset_password_link($params, &$service)
+function ws_users_generate_password_link($params, &$service)
 {
   global $user, $conf;
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
@@ -1020,19 +1020,19 @@ function ws_users_generate_reset_password_link($params, &$service)
     return new PwgError(403, 'You cannot perform this action');
   }
 
-  $generate_link = generate_reset_password_link($params['user_id']);
+  $first_login = first_connexion($params['user_id']);
+  $generate_link = generate_password_link($params['user_id'], $first_login);
   $send_by_mail_response = null;
 
   if ($params['send_by_mail'] and !empty($user_lost['email']))
   {
-    $first_login = first_connexion($params['user_id']);
     if ($first_login)
     {
-      $email_params = pwg_generate_set_password_mail($user_lost['username'], $generate_link['reset_password_link'], $conf['gallery_title']);
+      $email_params = pwg_generate_set_password_mail($user_lost['username'], $generate_link['password_link'], $conf['gallery_title'], $generate_link['time_validation']);
     }
     else
     {
-      $email_params = pwg_generate_reset_password_mail($user_lost['username'], $generate_link['reset_password_link'], $conf['gallery_title']);
+      $email_params = pwg_generate_reset_password_mail($user_lost['username'], $generate_link['password_link'], $conf['gallery_title'], $generate_link['time_validation']);
     }
     // Here we remove the display of errors because they prevent the response from being parsed
     if (@pwg_mail($user_lost['email'], $email_params))
@@ -1046,8 +1046,9 @@ function ws_users_generate_reset_password_link($params, &$service)
   }
   
   return array(
-    'generated_link' => $generate_link['reset_password_link'],
+    'generated_link' => $generate_link['password_link'],
     'send_by_mail' => $send_by_mail_response,
+    'time_validation' => $generate_link['time_validation'],
   );
 }