Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix magic URL token length

Browse Source
This commit is contained in:
Damodar Lohani
2025-09-14 05:23:30 +00:00
parent cfa4530797
commit 800db0b99d
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/api/account.php
+3 -2
View File
@@ -2034,7 +2034,8 @@ App::post('/v1/account/tokens/magic-url')
Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
}
$tokenSecret = $proofForToken->generate();
$proofsForTokenMagicUrl = new ProofsToken(TOKEN_LENGTH_MAGIC_URL);
$tokenSecret = $proofsForTokenMagicUrl->generate();
$expire = DateTime::formatTz(DateTime::addSeconds(new \DateTime(), TOKEN_EXPIRATION_CONFIRM));
$token = new Document([
@@ -2042,7 +2043,7 @@ App::post('/v1/account/tokens/magic-url')
'userId' => $user->getId(),
'userInternalId' => $user->getSequence(),
'type' => TOKEN_TYPE_MAGIC_URL,
'secret' => $proofForToken->hash($tokenSecret), // One way hash encryption to protect DB leak
'secret' => $proofsForTokenMagicUrl->hash($tokenSecret), // One way hash encryption to protect DB leak
'expire' => $expire,
'userAgent' => $request->getUserAgent('UNKNOWN'),
'ip' => $request->getIP(),
tests/e2e/Services/Account/AccountCustomClientTest.php
+1 -1
View File
@@ -2698,7 +2698,7 @@ class AccountCustomClientTest extends Scope
$this->assertStringContainsStringIgnoringCase('Sign in to '. $this->getProject()['name'] . ' with your secure link. Expires in 1 hour.', $lastEmail['text']);
$this->assertStringNotContainsStringIgnoringCase('security phrase', $lastEmail['text']);
$token = substr($lastEmail['text'], strpos($lastEmail['text'], '&secret=', 0) + 8, 256);
$token = substr($lastEmail['text'], strpos($lastEmail['text'], '&secret=', 0) + 8, 64);
$expireTime = strpos($lastEmail['text'], 'expire=' . urlencode($response['body']['expire']), 0);