From d6d623ac3e2e687f99911d874759ba27ddfa7a4f Mon Sep 17 00:00:00 2001
From: BroNiz4m <178691121+BroNiz4m@users.noreply.github.com>
Date: Thu, 23 Jul 2026 02:58:24 +0800
Subject: [PATCH] Invalidate remember-me sessions after password reset

---
 qa-include/app/users-edit.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa-include/app/users-edit.php b/qa-include/app/users-edit.php
index b287db248..d339b1d90 100644
--- a/qa-include/app/users-edit.php
+++ b/qa-include/app/users-edit.php
@@ -533,7 +533,7 @@ function qa_finish_reset_user($userId, $newPassword)
 	require_once QA_INCLUDE_DIR . 'app/users.php';
 
 	qa_db_user_set_password($userId, $newPassword);
-
+	qa_db_user_set($userId, 'sessioncode', ''); // stop old 'Remember me' style logins from still working
 	qa_db_user_set($userId, 'emailcode', ''); // to prevent re-use of the code
 
 	$userInfo = qa_db_select_with_pending(qa_db_user_account_selectspec($userId, true));