23 lines
764 B
JavaScript
23 lines
764 B
JavaScript
'use strict';
|
|
|
|
const $ = (id) => document.getElementById(id);
|
|
|
|
// The token is read here rather than acted on by the server during the GET:
|
|
// mail scanners fetch every link in an inbound message, and a link that acted
|
|
// on GET would be spent before anyone clicked it.
|
|
const token = A.qs('token');
|
|
|
|
if (!token) {
|
|
$('form-panel').hidden = true;
|
|
$('bad-panel').hidden = false;
|
|
$('bad-text').textContent = 'That link is missing its token. Ask for a new one.';
|
|
}
|
|
|
|
A.wire($('form'), $('submit'), $('note'), async () => {
|
|
if ($('password').value !== $('confirm').value) {
|
|
throw new Error('Those two passwords are not the same.');
|
|
}
|
|
await A.postJSON('/api/auth/reset', { token, password: $('password').value });
|
|
location.replace('/login?reset=1');
|
|
});
|