[members] secure password reset token generation

Countly · May 5, 2022 · 2bfa1ee · 2bfa1ee
1 parent bc5e4b0
commit 2bfa1ee
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/frontend/express/libs/members.js b/frontend/express/libs/members.js
@@ -809,7 +809,7 @@ membersUtility.forgot = function(req, callback) {
         membersUtility.db.collection('members').findOne({"email": email}, function(err, member) {
             if (member) {
                 var timestamp = Math.round(new Date().getTime() / 1000),
-                    prid = sha512Hash(member.username + member.full_name, timestamp);
+                    prid = crypto.randomBytes(32).toString('hex');
                 member.lang = member.lang || req.body.lang || "en";
                 membersUtility.db.collection('password_reset').insert({"prid": prid, "user_id": member._id, "timestamp": timestamp}, {safe: true}, function() {
                     countlyMail.sendPasswordResetInfo(member, prid);