Merge pull request #3952 from mikebigun/bugfix/DNN-42078

Reset invalidation link on email change
dnnsoftware · Aug 4, 2020 · c7c5e72 · c7c5e72
2 parents a648f35 + d749960
commit c7c5e72
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/DNN Platform/Website/DesktopModules/Admin/Security/EditUser.ascx.cs b/DNN Platform/Website/DesktopModules/Admin/Security/EditUser.ascx.cs
@@ -292,6 +292,10 @@ protected void cmdUpdate_Click(object sender, EventArgs e)
                     // Clear the Portal Cache
                     DataCache.ClearPortalCache(this.UserPortalID, true);
                 }
+                else
+                {
+                    DataCache.ClearUserCache(this.PortalId, this.User.Username);
+                }
 
                 try
                 {
@@ -308,6 +312,14 @@ protected void cmdUpdate_Click(object sender, EventArgs e)
                         }
                     }
 
+                    var prevUserEmail = UserController.Instance.GetUserById(this.PortalId, this.UserId)?.Email;
+
+                    if (!string.IsNullOrWhiteSpace(prevUserEmail) && !prevUserEmail.Equals(this.User.Email, StringComparison.OrdinalIgnoreCase))
+                    {
+                        // on email address change need to invalidate existing 'reset password' link
+                        this.User.PasswordResetExpiration = Null.NullDate;
+                    }
+
                     UserController.UpdateUser(this.UserPortalID, this.User);
 
                     // make sure username matches possibly changed email address