From 5ab33fbca8d7af6586d0c656aa7a75a6e0339dc9 Mon Sep 17 00:00:00 2001
From: HF <hf@pixelplanet.fun>
Date: Fri, 15 Jul 2022 16:23:48 +0200
Subject: [PATCH] fix password-reset-code vulnerability

---
 src/components/UserMessages.jsx | 6 ++++--
 src/core/mail.js                | 5 +++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/components/UserMessages.jsx b/src/components/UserMessages.jsx
index 69241f2..66859b4 100644
--- a/src/components/UserMessages.jsx
+++ b/src/components/UserMessages.jsx
@@ -24,8 +24,10 @@ const UserMessages = () => {
       {messages.includes('not_verified')
         && (
           <p className="usermessages">
-            {t`Please verify your mail address&nbsp;
-            or your account could get deleted after a few days.`}
+            {
+              // eslint-disable-next-line max-len
+              t`Please verify your mail address or your account could get deleted after a few days.`
+            }
             {(verifyAnswer)
               ? (
                 <span
diff --git a/src/core/mail.js b/src/core/mail.js
index 29eb7b2..ec61720 100644
--- a/src/core/mail.js
+++ b/src/core/mail.js
@@ -4,6 +4,7 @@
 
 /* eslint-disable max-len */
 
+import { randomUUID } from 'crypto';
 import nodemailer from 'nodemailer';
 
 import logger from './logger';
@@ -200,6 +201,10 @@ class MailProvider {
     return `${part1}-${part2}`;
   }
 
+  static createCode() {
+    return randomUUID();
+  }
+
   static cleanUsers() {
     // delete users that requier verification for more than 4 days
     /*