mrlan
/
LRR
4
0
Fork 2
Code Issues Pull Requests 7 Projects Releases Wiki Activity

Implement email password recovery feature for LRR system #75

Open
zayid wants to merge 1 commits from Bug197-Zayid-V2 into Hui-Organize
pull from: Bug197-Zayid-V2
merge into: mrlan:Hui-Organize
Conversation 3 Commits 1 Files Changed 10
zayid commented 2025-05-25 06:22:22 +08:00

Features implemented:

  • Email-based password recovery using 163.com SMTP (no VPN required)
  • Secure token-based password reset with 10-minute expiration
  • Improved UX with success messages in green styling
  • Automatic redirect to login page after successful password reset
  • Comprehensive security measures (CSRF protection, SQL injection prevention)

Technical changes:

  • Added password_reset_tokens table to database schema
  • Updated Script.php with password recovery logic
  • Enhanced index.php and recover_password.php with success message styling
  • Migrated from Gmail SMTP to 163.com SMTP for better reliability

Testing:

  • All teacher-provided tests: 12/12 passed (141.63s)
  • Email password recovery tests: 2/2 passed (22.55s)
  • Total success rate: 100%

Security features:

  • Time-limited tokens (10-minute expiration)
  • Secure token generation using bin2hex(random_bytes(32))
  • Foreign key constraints for data integrity
  • Rate limiting considerations

Fixes: Bug #197 - Password recovery functionality

Features implemented: - Email-based password recovery using 163.com SMTP (no VPN required) - Secure token-based password reset with 10-minute expiration - Improved UX with success messages in green styling - Automatic redirect to login page after successful password reset - Comprehensive security measures (CSRF protection, SQL injection prevention) Technical changes: - Added password_reset_tokens table to database schema - Updated Script.php with password recovery logic - Enhanced index.php and recover_password.php with success message styling - Migrated from Gmail SMTP to 163.com SMTP for better reliability Testing: - All teacher-provided tests: 12/12 passed (141.63s) - Email password recovery tests: 2/2 passed (22.55s) - Total success rate: 100% Security features: - Time-limited tokens (10-minute expiration) - Secure token generation using bin2hex(random_bytes(32)) - Foreign key constraints for data integrity - Rate limiting considerations Fixes: Bug #197 - Password recovery functionality
zayid added 1 commit 2025-05-25 06:22:23 +08:00
a01f30c887 Implement email password recovery feature for LRR system 
Features implemented:
- Email-based password recovery using 163.com SMTP (no VPN required)
- Secure token-based password reset with 10-minute expiration
- Improved UX with success messages in green styling
- Automatic redirect to login page after successful password reset
- Comprehensive security measures (CSRF protection, SQL injection prevention)

Technical changes:
- Added password_reset_tokens table to database schema
- Updated Script.php with password recovery logic
- Enhanced index.php and recover_password.php with success message styling
- Migrated from Gmail SMTP to 163.com SMTP for better reliability

Testing:
- All teacher-provided tests: 12/12 passed (141.63s)
- Email password recovery tests: 2/2 passed (22.55s)
- Total success rate: 100%

Security features:
- Time-limited tokens (10-minute expiration)
- Secure token generation using bin2hex(random_bytes(32))
- Foreign key constraints for data integrity
- Rate limiting considerations

Fixes: Bug #197 - Password recovery functionality
mrlan commented 2025-05-26 08:03:26 +08:00
Owner

@zayid
Thanks. I will check.

@zayid Thanks. I will check.
zayid commented 2025-05-27 18:04:51 +08:00
Poster

@mrlan ok teacher, thanks.

@mrlan ok teacher, thanks.
mrlan commented 2025-07-10 16:15:06 +08:00
Owner

@zayid

I can confirm that this pull request contains valid implementation for email-based password resetting.

Great job. Thanks.

However, I decided to merge pull request 73 instead because that one does not require smtp setup.

Perhaps in the future I will adopt the email-based approach when needs arise.
For now, let's see how the user would like the security question-based approach (i.e., pull request 73's approach).

@zayid I can confirm that this pull request contains valid implementation for email-based password resetting. Great job. Thanks. However, I decided to merge pull request 73 instead because that one does not require smtp setup. Perhaps in the future I will adopt the email-based approach when needs arise. For now, let's see how the user would like the security question-based approach (i.e., pull request 73's approach).
This pull request has changes conflicting with the target branch.
  • Script.php
  • index.php
  • recover_password.php
You can also view command line instructions.

Step 1:

From your project repository, check out a new branch and test the changes.
git checkout -b Bug197-Zayid-V2 Hui-Organize
git pull origin Bug197-Zayid-V2

Step 2:

Merge the changes and update on Gitea.
git checkout Hui-Organize
git merge --no-ff Bug197-Zayid-V2
git push origin Hui-Organize
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: mrlan/LRR#75
There is no content yet.
Delete Branch "Bug197-Zayid-V2"

Deleting a branch is permanent. Although the deleted branch may exist for a short time before cleaning up, in most cases it CANNOT be undone. Continue?