Delete existing user_keys, if password is changed

plugins/system/remember/remember.php

@@ -94,4 +94,55 @@ public function onUserLogout($user, $options)
 
 		return true;
 	}
+
+	/**
+	 * Method is called before user data is stored in the database
+	 * Invalidate all existing remember-me cookies after a password change
+	 *
+	 * @param   array    $user   Holds the old user data.
+	 * @param   boolean  $isnew  True if a new user is stored.
+	 * @param   array    $data   Holds the new user data.
+	 *
+	 * @return    boolean
+	 *
+	 * @since   __DEPLOY_VERSION__
+	 */
+	public function onUserBeforeSave($user, $isnew, $data)
+	{
+		// Irrelevant on new users
+		if ($isnew)
+		{
+			return true;
+		}
+
+		// Irrelevant, because password was not changed by user
+		if ($data['password_clear'] == '')
+		{
+			return true;
+		}
+
+		/*
+		 * But now, we need to do something 
+		 * Delete all tokens for this user!
+		 */
+		$db = JFactory::getDbo();
+		$query = $db->getQuery(true)
+			->delete('#__user_keys')
+			->where($db->quoteName('user_id') . ' = ' . $db->quote($user['username']));
+		try
+		{
+			$db->setQuery($query)->execute();
+		}
+		catch (RuntimeException $e)
+		{
+			// Log an alert for the site admin
+			JLog::add(
+				sprintf('Failed to delete cookie token for user %s with the following error: %s', $user['username'], $e->getMessage()),
+				JLog::WARNING,
+				'security'
+			);
+		}
+
+		return true;
+	}
 }