33 lines
963 B
PHP
33 lines
963 B
PHP
<?php
|
|
require __DIR__ . '/_bootstrap.php';
|
|
require __DIR__ . '/_codes.php';
|
|
require __DIR__ . '/_mail.php';
|
|
|
|
/**
|
|
* @OA\Post(
|
|
* path="/password-forgot.php",
|
|
* tags={"Auth"},
|
|
* summary="Send a password reset code",
|
|
* description="Always answers 200, even for an unknown e-mail, so the endpoint cannot be used to enumerate accounts.",
|
|
* security={},
|
|
* @OA\RequestBody(required=true, @OA\JsonContent(
|
|
* required={"email"},
|
|
* @OA\Property(property="email", type="string", format="email")
|
|
* )),
|
|
* @OA\Response(response=200, ref="#/components/responses/Success")
|
|
* )
|
|
*/
|
|
require_method('POST');
|
|
|
|
$email = trim((string) (body()['email'] ?? ''));
|
|
|
|
if ($email !== '') {
|
|
$stmt = $pdo->prepare('SELECT id FROM auth_users WHERE email = ? LIMIT 1');
|
|
$stmt->execute([$email]);
|
|
if ($stmt->fetchColumn() && $code = issue_code($pdo, 'auth_password_resets', $email)) {
|
|
send_code_mail($email, $code, true);
|
|
}
|
|
}
|
|
|
|
json_ok();
|