Reduce password reset token expiration latency to 1 hour #3244
Conversation
| @@ -241,12 +241,12 @@ | |||
| <value>The word on the street is you lost your password. Sorry to hear it! | |||
| If you haven't forgotten your password you can safely ignore this email. Your password has not been changed. | |||
|
|
|||
| Click the following link within the next {0} hours to reset your password: | |||
| Click the following link within the next hour to reset your password: | |||
There was a problem hiding this comment.
Won't this break if somebody makes their own instance of the gallery and sets the password reset token expiration to something else?
There was a problem hiding this comment.
Exactly if this is configurable it can be reduced to a lower number, and the message should apply. Perhaps we allow a minutes more to? CC @blowdart
There was a problem hiding this comment.
Minutes are always good. But having been on the end of a flickr lockout because the time it took to send me the email was longer than the token expiry ... it does need configuring. I'd almost default to 15 minutes, but support hours in both code and text, but then I'm mean.
There was a problem hiding this comment.
Password expiration time is a constant in our code, so if someone modifies it, he might as well modify the message.
There was a problem hiding this comment.
Changed the constant from DefaultPasswordResetTokenExpirationHours to PasswordResetTokenExpirationHours 😄
… PasswordResetTokenExpirationHours
, all okay with this!
@yishaigalatzer @qianjun22 @maartenba