svenstaro/flamejam — pull request #64 by BruceJillis (2012-08-10 15:03:59+00:00)
Title: Password Reset

Description
---------------
So like I mentioned on IRC I have implemented a password reset function. It is very simple and close to what has already been implemented in the codebase. I added a single nullable integer field to the participant table (token) that is NULL by default, once a participant requests a password change it fills this field with a random integer between 0 and sys.maxint. This integer in turn is hashed with the configured secret and the first 8 chars of this string is sent via email to the requesting participant. This email contains a link to the password change page which will only allow someone to view the page if the username and the reset token supplied in the url correspond to the data retrieved from the database. The user can then supply a new password (which has to be entered 2 times for verification) and once this password passes validation the token field will be reset to NULL and the password will have been changed.

Things of Note
--------------------
If a user requests multiple resets only the last reset token will be valid. You cannot change the secret mid flight (it will treat valid tokens as invalid). A malicious user might be able to dos the website to some extent if the email server isn't powerful enough to send emails at a sufficient rate by spam-clicking the reset button. If this is a concern it might be prudent to disallow multiple resets and disallow resets once the token field has been set.