[postfixadmin/postfixadmin] e63809: Harden password recovery requests (#1130)

[Rodrigo C. C. <no...@gi...>]

  Branch: refs/heads/master
  Home:   https://github.com/postfixadmin/postfixadmin
  Commit: e638095d5828abef9ae1d583048c1f5abbc341dd
      https://github.com/postfixadmin/postfixadmin/commit/e638095d5828abef9ae1d583048c1f5abbc341dd
  Author: Rodrigo Cortés Cano <384...@us...>
  Date:   2026-08-29 (Sat, 29 Aug 2026)

  Changed paths:
    M config.inc.php
    M functions.inc.php
    M model/Login.php
    M public/users/password-recover.php
    M tests/GetSiteUrlTest.php
    M tests/LoginTest.php
    A tests/PasswordRecoveryResponseTest.php

  Log Message:
  -----------
  Harden password recovery requests (#1130)

Require a validated canonical site_url for recovery links, keep responses uniform, and persist a five-minute per-account request limit.

The token update is atomic across supported database engines and performs the same password hashing work for unknown accounts.

Refs #1128

thanks @TrapoSAMA



To unsubscribe from these emails, change your notification settings at https://github.com/postfixadmin/postfixadmin/settings/notifications