From 11b5304cb9d4c6c591db4e5efcca5365779d653c Mon Sep 17 00:00:00 2001
From: Girish Ramakrishnan <girish@cloudron.io>
Date: Thu, 13 Feb 2020 22:45:07 -0800
Subject: [PATCH] userdb: only pass specific fields to update

---
 src/users.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/users.js b/src/users.js
index 4288831d0..430bbee50 100644
--- a/src/users.js
+++ b/src/users.js
@@ -480,9 +480,10 @@ function resetPasswordByIdentifier(identifier, callback) {
     getter(identifier.toLowerCase(), function (error, result) {
         if (error) return callback(error);
 
-        result.resetToken = hat(256);
+        let resetToken = hat(256);
+        result.resetToken = resetToken;
 
-        userdb.update(result.id, result, function (error) {
+        userdb.update(result.id, { resetToken }, function (error) {
             if (error) return callback(error);
 
             mailer.passwordReset(result);