fix(forgot-password): allow aliases (x+y@z.com) in email lookup, fixes #3805

2014-07-29 12:58:31 -06:00
parent fc910d70a8
commit a2df27d7f2
1 changed files with 3 additions and 1 deletions
@@ -173,7 +173,9 @@ api.resetPassword = function(req, res, next){
    newPassword =  utils.makeSalt(), // use a salt as the new password too (they'll change it later)
    hashed_password = utils.encryptPassword(newPassword, salt);

-  User.findOne({'auth.local.email':new RegExp("^"+email+"$","i")}, function(err, user){
+  // escape email for regex, then search case-insensitive. See http://stackoverflow.com/a/3561711/362790
+  var emailRegExp = new RegExp('^' + email.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&') + '$', 'i');
+  User.findOne({'auth.local.email':emailRegExp}, function(err, user){
    if (err) return next(err);
    if (!user) return res.send(500, {err:"Couldn't find a user registered for email " + email});
    user.auth.local.salt = salt;