5

In what table is the token to reset a password saved? How is the token generated?

4

The password reset procedure happens in the following model

components\com_users\models\reset.php

The token is generated by the following code just prior to the email being sent to the user:

// Set the confirmation token.
    $token = JApplicationHelper::getHash(JUserHelper::genRandomPassword());
    $hashedToken = JUserHelper::hashPassword($token);

    $user->activation = $hashedToken;

As you can probably tell from the fuction names, this generates a random password and saves it as a secure hash in the activation field of the users table.

When the user resets their password, various checks are run, but this is the one that tests that the token matches the one the user has just entered.

if (empty($user) || $user->activation !== $token)
        {
            $this->setError(JText::_('COM_USERS_USER_NOT_FOUND'));

            return false;
        }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.