src/Module/Authentication/LocalAuth/PasswordReset.php
protected function checkResetLink()
    {
        // Check if the reset links are enabled, if token is present,
        // if it has a valid format and length
        if (!$this->config["enabled"]
            || !($token = $this->httpRequest->query->get("confirm", false))
            || !preg_match("/^[a-f0-9]+$/", $token)
            || strlen($token) !== 2*($this->config["tokenIdLen"]+$this->config["tokenLen"])) {
            return;
        }

        // Delete the active password reset session, if set
        $this->session->remove("pwreset");
        
        // Split token parts
        $tokenId = substr($token, 0, 2 * $this->config["tokenIdLen"]);
        $verifier = substr($token, 2 * $this->config["tokenIdLen"]);

        // Validate token timeout
        $tokenData = $this->storage->getResetToken($tokenId);

        // Token not found or expired
        if (!$tokenData || time() > $tokenData['valid']) {
            $this->session->addFlash("error", "Reset link has expired.");
            $this->getLogger()->warning("Bad reset token {t} from {addr}", [$token, $_SERVER['REMOTE_ADDR']]);
            $this->picoAuth->redirectToPage("password_reset");
        }

        if (hash_equals($tokenData['token'], hash('sha256', $verifier))) {
            $this->session->addFlash("success", "Please set a new password.");
            $this->startPasswordResetSession($tokenData['user']);
            $this->logResetLinkVisit($tokenData);
            $this->picoAuth->redirectToPage("password_reset");
        }
    }
protected function checkResetLink()
    {
        // Check if the reset links are enabled, if token is present,
        // if it has a valid format and length
        if (!$this->config["enabled"]
            || !($token = $this->httpRequest->query->get("confirm", false))
            || !preg_match("/^[a-f0-9]+$/", $token)
            || strlen($token) !== 2*($this->config["tokenIdLen"]+$this->config["tokenLen"])) {
            return;
        }

        // Delete the active password reset session, if set
        $this->session->remove("pwreset");
        
        // Split token parts
        $tokenId = substr($token, 0, 2 * $this->config["tokenIdLen"]);
        $verifier = substr($token, 2 * $this->config["tokenIdLen"]);

        // Validate token timeout
        $tokenData = $this->storage->getResetToken($tokenId);

        // Token not found or expired
        if (!$tokenData || time() > $tokenData['valid']) {
            $this->session->addFlash("error", "Reset link has expired.");
            $this->getLogger()->warning("Bad reset token {t} from {addr}", [$token, $_SERVER['REMOTE_ADDR']]);
            $this->picoAuth->redirectToPage("password_reset");
        }

        if (hash_equals($tokenData['token'], hash('sha256', $verifier))) {
            $this->session->addFlash("success", "Please set a new password.");
            $this->startPasswordResetSession($tokenData['user']);
            $this->logResetLinkVisit($tokenData);
            $this->picoAuth->redirectToPage("password_reset");
        }
    }
Validates a password reset link

If a valid password reset link was provided, starts a password reset
session and redirects to a password change form

@return void