Version 4.1.19

system/Login/Internal.php

@@ -2,9 +2,9 @@
 /**
  * @brief		Internal Login Handler
  * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
- * @copyright	(c) 2001 - SVN_YYYY Invision Power Services, Inc.
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
  * @license		http://www.invisionpower.com/legal/standards/
- * @package		IPS Social Suite
+ * @package		IPS Community Suite
  * @since		13 Mar 2013
  * @version		SVN_VERSION_NUMBER
  */
@@ -173,16 +173,6 @@ class _Internal extends LoginAbstract
 		return FALSE;
 	}
 	
-	/**
-	 * [Node] Does the currently logged in user have permission to delete this node?
-	 *
-	 * @return	bool
-	 */
-	public function canDelete()
-	{
-		return FALSE; # this is bad, mkay
-	}
-	
 	/**
 	 * Can a member change their email/password with this login handler?
 	 *
@@ -255,9 +245,18 @@ class _Internal extends LoginAbstract
 	 */
 	public function changePassword( \IPS\Member $member, $newPassword )
 	{
-		$member->members_pass_salt = $member->generateSalt();
-		$member->members_pass_hash = $member->encryptedPassword( $newPassword );
-		$member->save();
+		/* Clear any current sessions for this user. This resolves an issue where a user resets their password in one location, but a malicious
+			user with access to their account can retain access in another location. */
+		\IPS\Db::i()->delete( 'core_sessions', array( 'member_id=?', $member->member_id ) );
+		\IPS\Db::i()->delete( 'core_sys_cp_sessions', array( 'session_member_id=?', $member->member_id ) );
+
+		$member->members_pass_salt	= $member->generateSalt();
+		$member->members_pass_hash	= $member->encryptedPassword( $newPassword );
+		$member->member_login_key	= '';
+		/* When we reset the login key and call checkLoginKey(), it will save for us. Note that we are NOT sending an updated pass_hash cookie
+			here, and that is instead the responsibility of any controllers that result in the password being updated. This is a central class
+			and we may not be updating the current viewing user's password at this point. */
+		$member->checkLoginKey();
 		$member->memberSync( 'onPassChange', array( $newPassword ) );
 	}