Version 4.7.0

applications/core/modules/front/system/lostpass.php

@@ -136,6 +136,10 @@ class _lostpass extends \IPS\Dispatcher\Controller
 	{
 		/* If we have an existing validation record, we can just reuse it */
 		$sendEmail = TRUE;
+
+		/* Delete any lost pass validating records that are older than 45 minutes - These records are only valid for one hour. */
+		\IPS\Db::i()->delete( 'core_validating', [ 'member_id=? AND lost_pass=1 AND entry_date<?', $member->member_id, time() - 2700 ] );
+
 		try
 		{
 			$existing = \IPS\Db::i()->select( array( 'vid', 'email_sent' ), 'core_validating', array( 'member_id=? AND lost_pass=1', $member->member_id ) )->first();
@@ -200,6 +204,12 @@ class _lostpass extends \IPS\Dispatcher\Controller
 		{
 			\IPS\Output::i()->error( 'no_validation_key', '2S151/1', 410, '' );
 		}
+
+		/* Show a nicer error message if their link has expired */
+		if( $record['entry_date'] < \IPS\DateTime::create()->sub( new \DateInterval( 'PT1H' ) )->getTimestamp() )
+		{
+			\IPS\Output::i()->error( 'lost_pass_expired', '2S151/4', 410, '' );
+		}
 		
 		/* Show form for new password */
 		$form =  new \IPS\Helpers\Form( "resetpass", 'save' );