[2.x] fix: enforce expiry check on password reset token submission (#4550)

* [2.x] fix: enforce expiry check on password reset token submission

* fix phpstan: add @method annotation for validOrFail scope

* fix: use static method instead of scope for validOrFail to satisfy phpstan

Author: imorland

framework/core/src/Forum/Controller/SavePasswordController.php

@@ -42,7 +42,7 @@ public function handle(Request $request): ResponseInterface
     {
         $input = $request->getParsedBody();
 
-        $token = PasswordToken::findOrFail(Arr::get($input, 'passwordToken'));
+        $token = PasswordToken::validOrFail(Arr::get($input, 'passwordToken'));
 
         $password = Arr::get($input, 'password');
 

framework/core/src/User/PasswordToken.php

@@ -11,6 +11,7 @@
 
 use Carbon\Carbon;
 use Flarum\Database\AbstractModel;
+use Flarum\User\Exception\InvalidConfirmationTokenException;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Support\Str;
 
@@ -44,6 +45,23 @@ public static function generate(int $userId): static
         return $token;
     }
 
+    /**
+     * Find the token with the given ID, and assert that it has not expired.
+     *
+     * @throws InvalidConfirmationTokenException
+     */
+    public static function validOrFail(string $id): static
+    {
+        /** @var static|null $token */
+        $token = static::find($id);
+
+        if (! $token || $token->created_at->diffInDays(null, true) >= 1) {
+            throw new InvalidConfirmationTokenException;
+        }
+
+        return $token;
+    }
+
     /**
      * @return BelongsTo<User, $this>
      */

framework/core/tests/integration/api/users/PasswordTokenExpiryTest.php

@@ -0,0 +1,77 @@
+<?php
+
+/*
+ * This file is part of Flarum.
+ *
+ * For detailed copyright and license information, please view the
+ * LICENSE file that was distributed with this source code.
+ */
+
+namespace Flarum\Tests\integration\api\users;
+
+use Carbon\Carbon;
+use Flarum\Testing\integration\RetrievesAuthorizedUsers;
+use Flarum\Testing\integration\TestCase;
+use Flarum\User\PasswordToken;
+use Flarum\User\User;
+use PHPUnit\Framework\Attributes\Test;
+
+class PasswordTokenExpiryTest extends TestCase
+{
+    use RetrievesAuthorizedUsers;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->prepareDatabase([
+            User::class => [
+                $this->normalUser(),
+            ],
+        ]);
+    }
+
+    #[Test]
+    public function valid_password_reset_token_is_accepted(): void
+    {
+        $this->app();
+
+        $token = PasswordToken::generate(2);
+        $token->save();
+
+        $response = $this->send(
+            $this->requestWithCsrfToken(
+                $this->request('POST', '/reset')->withParsedBody([
+                    'passwordToken' => $token->token,
+                    'password' => 'new-password',
+                    'password_confirmation' => 'new-password',
+                ])
+            )
+        );
+
+        $this->assertEquals(302, $response->getStatusCode());
+    }
+
+    #[Test]
+    public function expired_password_reset_token_is_rejected(): void
+    {
+        $this->app();
+
+        $token = PasswordToken::generate(2);
+        $token->created_at = Carbon::now()->subDays(2);
+        $token->save();
+
+        $response = $this->send(
+            $this->requestWithCsrfToken(
+                $this->request('POST', '/reset')->withParsedBody([
+                    'passwordToken' => $token->token,
+                    'password' => 'new-password',
+                    'password_confirmation' => 'new-password',
+                ])
+            )
+        );
+
+        // Should be rejected — currently findOrFail accepts expired tokens
+        $this->assertNotEquals(302, $response->getStatusCode());
+    }
+}