Codeigniter users table being compromised - php

Question

I have a reset password form on my site and I'm unsure whether it's being compromised or if my code is just flakey. The process goes like this:
User enters email address of forgotten password
Password is changed in DB and email is sent to use
User can now login with new password and change once in their account
(I realise this is an imperfect process but it's v1 of the site).
The problem is that intermittently all user passwords are being changed (to the same password) and I can't for the life of me figure it out. XSS and CSRF filters are both enabled inside Codeigniter.
Here's my code:
Controller
$this->form_validation->set_rules('email','Email address','required');
if ($this->form_validation->run() === FALSE)
{
$this->password_reset();
}
else
{
/**
* Generate a new password and send to model
*/
$newpass = substr(md5(rand()),0,10);
$this->users_model->reset_password($newpass);
// stuff for email here
$this->email->send();
/**
* Load view
**/
$data['content'] = 'content/login/reset_done';
$data['title'] = 'Password Reset';
$this->load->view($this->layout, $data);
}
}
Model
public function reset_password($newpass)
{
$email = $this->input->post('email');
$query = $this->db->get_where('users', array('user_email' => $email));
if($query->num_rows())
{
$newpass = do_hash($newpass, 'md5');
$this->db->where('user_email', $email);
$this->db->update('users', array('user_password' => $newpass));
}
}
So to repeat the problem once again: every so often all users passwords are being changed (to the same password). How is this happening?

Answer 1

In your model, don't use $this->input->post, instead send this data as an argument. (Because your model shouldn't act like a controller with routes/sessions/headers/etc information)
It is possible that this happens because $this->input->post('email') is empty or '' (in this case, it will update everybody and num_rows will return the total of users in database), you must check for :
public function reset_password($email, $newpass)
{
if(!$email || !$newpass)
return false;
$query = $this->db->get_where('users', array('user_email' => $email));
if($query->num_rows())
{
$newpass = do_hash($newpass, 'md5');
$this->db->where('user_email', $email);
$this->db->update('users', array('user_password' => $newpass));
}
}
EDIT
- You don't need to do 2 queries (check email then update)
public function reset_password($email, $newpass)
{
if(!$email || !$newpass)
return false;
$newpass = do_hash($newpass, 'md5');
$this->db->where('user_email', $email);
$this->db->update('users', array('user_password' => $newpass));
if ($this->db->affected_rows() < 1) {
return false; //Email wasn't found
} else {
return true;
}
}
You can also call for $this->db->last_query(); to see the query and if the where() did work.

Answer 2

this is not an answer to your specific question, but it needs to be addressed, and it was too long for a comment.
DO NOT use MD5 as a hashing mechanism for passwords. it is outdated, and basically provides zero security anymore. instead use PHPs password_hash() and if you don't have PHP5.5 use the compatibility library. it's very easy to use and works great, and uses better hashing algorithms.
second, it is not generally good practice to create a new password for a user. rather create a token that expires within 1 hour of the request, and then pass that along in the email. then the user enters their email, token, and new password.
and because I can't say it enough, DONT USE MD5