1 files changed, 47 insertions, 38 deletions

diff --git a/src/main/java/org/traccar/api/resource/PasswordResource.java b/src/main/java/org/traccar/api/resource/PasswordResource.java
index 0642ff3cc..029e63a0c 100644
--- a/src/main/java/org/traccar/api/resource/PasswordResource.java
+++ b/src/main/java/org/traccar/api/resource/PasswordResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2021 Anton Tananaev (anton@traccar.org)
+ * Copyright 2021 - 2022 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,49 +15,55 @@
  */
 package org.traccar.api.resource;
 
-import org.apache.velocity.VelocityContext;
-import org.traccar.Context;
 import org.traccar.api.BaseResource;
+import org.traccar.api.signature.TokenManager;
+import org.traccar.mail.MailManager;
 import org.traccar.model.User;
-import org.traccar.notification.NotificationMessage;
 import org.traccar.notification.TextTemplateFormatter;
 import org.traccar.storage.StorageException;
+import org.traccar.storage.query.Columns;
+import org.traccar.storage.query.Condition;
+import org.traccar.storage.query.Request;
 
-import javax.annotation.security.PermitAll;
-import javax.mail.MessagingException;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.util.UUID;
+import jakarta.annotation.security.PermitAll;
+import jakarta.inject.Inject;
+import jakarta.mail.MessagingException;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
 
 @Path("password")
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
 public class PasswordResource extends BaseResource {
 
-    private static final String PASSWORD_RESET_TOKEN = "passwordToken";
+    @Inject
+    private MailManager mailManager;
+
+    @Inject
+    private TokenManager tokenManager;
+
+    @Inject
+    private TextTemplateFormatter textTemplateFormatter;
 
     @Path("reset")
     @PermitAll
     @POST
-    public Response reset(@FormParam("email") String email) throws StorageException, MessagingException {
-        for (long userId : Context.getUsersManager().getAllItems()) {
-            User user = Context.getUsersManager().getById(userId);
-            if (email.equals(user.getEmail())) {
-                String token = UUID.randomUUID().toString().replaceAll("-", "");
-                user.set(PASSWORD_RESET_TOKEN, token);
-                Context.getUsersManager().updateItem(user);
-                VelocityContext velocityContext = TextTemplateFormatter.prepareContext(null);
-                velocityContext.put("token", token);
-                NotificationMessage fullMessage =
-                        TextTemplateFormatter.formatMessage(velocityContext, "passwordReset", "full");
-                Context.getMailManager().sendMessage(userId, fullMessage.getSubject(), fullMessage.getBody());
-                break;
-            }
+    public Response reset(@FormParam("email") String email)
+            throws StorageException, MessagingException, GeneralSecurityException, IOException {
+
+        User user = storage.getObject(User.class, new Request(
+                new Columns.All(), new Condition.Equals("email", email)));
+        if (user != null) {
+            var velocityContext = textTemplateFormatter.prepareContext(permissionsService.getServer(), user);
+            var fullMessage = textTemplateFormatter.formatMessage(velocityContext, "passwordReset", "full");
+            mailManager.sendMessage(user, true, fullMessage.getSubject(), fullMessage.getBody());
         }
         return Response.ok().build();
     }
@@ -66,15 +72,18 @@ public class PasswordResource extends BaseResource {
     @PermitAll
     @POST
     public Response update(
-            @FormParam("token") String token, @FormParam("password") String password) throws StorageException {
-        for (long userId : Context.getUsersManager().getAllItems()) {
-            User user = Context.getUsersManager().getById(userId);
-            if (token.equals(user.getString(PASSWORD_RESET_TOKEN))) {
-                user.getAttributes().remove(PASSWORD_RESET_TOKEN);
-                user.setPassword(password);
-                Context.getUsersManager().updateItem(user);
-                return Response.ok().build();
-            }
+            @FormParam("token") String token, @FormParam("password") String password)
+            throws StorageException, GeneralSecurityException, IOException {
+
+        long userId = tokenManager.verifyToken(token);
+        User user = storage.getObject(User.class, new Request(
+                new Columns.All(), new Condition.Equals("id", userId)));
+        if (user != null) {
+            user.setPassword(password);
+            storage.updateObject(user, new Request(
+                    new Columns.Include("hashedPassword", "salt"),
+                    new Condition.Equals("id", userId)));
+            return Response.ok().build();
         }
         return Response.status(Response.Status.NOT_FOUND).build();
     }