From a4d7b0e623ebe2e17d8f68d353e306a1162888cb Mon Sep 17 00:00:00 2001
From: Guilherme Torquato <gtorquato@proton.me>
Date: Mon, 24 Jun 2024 10:30:24 -0300
Subject: [PATCH] fix: race condition in password reset

---
 src/app/Controller/UsersController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/app/Controller/UsersController.php b/src/app/Controller/UsersController.php
index 4efadaa..c2ef30f 100644
--- a/src/app/Controller/UsersController.php
+++ b/src/app/Controller/UsersController.php
@@ -385,7 +385,7 @@ public function recoveryPassword()
         if ($user['User']['source'] == 1) {
           $this->Session->setFlash(__('This account is registered with LinkedIn'));
         } elseif ($user['User']['confirmed']) {
-          $hash = sha1(time() . Configure::read('Security.Salt'));
+          $hash = sha1(time() . Configure::read('Security.Salt') . $email);
           $newPass = substr($hash, 0, 10);
           $user['User']['password'] = $newPass;
           $this->User->id = $email;