[labkey-adam]

Rationale

Store only a hash of the setup, password-reset, and email-change verification tokens and expire setup and reset links, so that database contents alone can't be used to take over an account. GH Issue 1644

Related Pull Requests

• GH Issue 1644: Hash verification tokens and expire setup and reset links testAutomation#3262

Changes

• Verification tokens are stored as SHA-256 hashes; an upgrade script hashes existing tokens in place
• Setup links expire after seven days and reset links after one day; existing pending links expire seven days after upgrade
• Verification tokens expire but are not deleted at expiration. This lets us distinguish already-used vs. never-used tokens to provide accurate user messaging.
• Tokens no longer appear in user history or the server log
• Because stored tokens can't be read back, the "show email" page masks the link; site admins can generate a new link there, which replaces the one already sent
• Add a new email template substitution that conveys token expiration. Update default templates with expiration text.