feat: Make password reset links single-use and revocable (#7627)

This commit is contained in:
Tiago
2026-04-01 07:12:37 +00:00
committed by GitHub
parent 6c3052f9e4
commit b975e7fa2e
43 changed files with 1495 additions and 115 deletions
@@ -30,6 +30,7 @@ These variables are present inside your machine's docker-compose file. Restart t
| IMPRINT_ADDRESS | Address for imprint. | optional | |
| EMAIL_AUTH_DISABLED | Disables the ability for users to signup or login via email and password if set to 1. | optional | |
| PASSWORD_RESET_DISABLED | Disables password reset functionality if set to 1. | optional | |
| PASSWORD_RESET_TOKEN_LIFETIME_MINUTES | Configures how long password reset links remain valid in minutes. Accepted values are integers from 5 to 120. | optional | 30 |
| EMAIL_VERIFICATION_DISABLED | Disables email verification if set to 1. | optional | |
| RATE_LIMITING_DISABLED | Disables rate limiting if set to 1. | optional | |
| DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS | Allows webhook URLs to point to internal/private network addresses (e.g. localhost, 192.168.x.x) if set to 1. Useful for self-hosted instances that need to send webhooks to internal services. | optional | |
+4
View File
@@ -64,6 +64,9 @@ EMAIL_VERIFICATION_DISABLED=0
# Set to 0 to enable password reset functionality (requires working SMTP)
PASSWORD_RESET_DISABLED=0
# Optional: configure the password reset link lifetime in minutes (5-120, default 30)
PASSWORD_RESET_TOKEN_LIFETIME_MINUTES=30
```
## Configuration for One-Click Setup
@@ -83,6 +86,7 @@ environment:
SMTP_PASSWORD: your_password
EMAIL_VERIFICATION_DISABLED: 0
PASSWORD_RESET_DISABLED: 0
PASSWORD_RESET_TOKEN_LIFETIME_MINUTES: 30
```
2. Or during the setup, answer "Yes" when prompted to set up the email service: