userdb: only pass specific fields to update

2020-02-13 22:45:07 -08:00
parent fd8abbe2ab
commit 11b5304cb9
1 changed files with 3 additions and 2 deletions
--- a/src/users.js
+++ b/src/users.js
@@ -480,9 +480,10 @@ function resetPasswordByIdentifier(identifier, callback) {
    getter(identifier.toLowerCase(), function (error, result) {
        if (error) return callback(error);

-        result.resetToken = hat(256);
+        let resetToken = hat(256);
+        result.resetToken = resetToken;

-        userdb.update(result.id, result, function (error) {
+        userdb.update(result.id, { resetToken }, function (error) {
            if (error) return callback(error);

            mailer.passwordReset(result);