Defense in depth: validate CSRF token when starting password reset flow (could be DoS bug at worse, allowing removal of an existing account's ability to log in; would not have revealed the reset code to the caller; cookie security would have prevented this POST)

Author: petergeneric

user-manager/service/src/main/java/com/peterphi/usermanager/ui/impl/UserUIServiceImpl.java

@@ -273,6 +273,8 @@ public Response changePassword(final int userId,
 	@AuthConstraint(role = UserLogin.ROLE_ADMIN)
 	public Response startPasswordResetFlow(final int userId, final String token)
 	{
+		tokenStore.validate(TOKEN_USE, token);
+
 		final String resetCode = passwordResetService.start(userId);
 
 		TemplateCall call = templater.template("reset_password_flow_started");