UserToken small fixes

core/Api/UserAPI.class.php

@@ -63,6 +63,7 @@ namespace Api\User {
   use Api\UserAPI;
   use DateTime;
   use Driver\SQL\Condition\Compare;
+  use Driver\SQL\Condition\CondBool;
   use Views\Account\ConfirmEmail;
 
   class Create extends UserAPI {
@@ -327,8 +328,7 @@ class Login extends UserAPI {
               $this->result['logoutIn'] = $this->user->getSession()->getExpiresSeconds();
               $this->success = true;
             }
-        }
-        else {
+          } else {
             return $this->wrongCredentials();
           }
         }
@@ -448,27 +448,30 @@ class CheckToken extends  UserAPI{
     }
 
     public function execute($values = array()) {
-        parent::execute($values);
+      if (!parent::execute($values)) {
+        return false;
+      }
 
       $token = $this->getParam('token');
       $sql = $this->user->getSQL();
-        $res = $sql->select("UserToken.token_type, User.name, User.email")->from("UserToken")
-            ->innerJoin("user", "UserToken.user_id","User.uid")
-            ->where(new Compare("UserToken.token",$token),
-                new Compare("UserToken.valid_until", $sql->now(), ">"))
+      $res = $sql->select("UserToken.token_type", "User.name", "User.email")
+        ->from("UserToken")
+        ->innerJoin("User", "UserToken.user_id", "User.uid")
+        ->where(new Compare("UserToken.token", $token))
+        ->where(new Compare("UserToken.valid_until", $sql->now(), ">"))
+        ->where(new Compare("UserToken.used", 0))
         ->execute();
       $this->lastError = $sql->getLastError();
       $this->success = ($res !== FALSE);
 
       if ($this->success) {
-            if(count($res) == 0) {
-                $this->lastError = "This token does not exist or is no longer valid";
-                $this->success = false;
-                return false;
+        if (count($res) > 0) {
+          $row = $res[0];
+          $this->result["token"] = array("type" => $row["token_type"]);
+          $this->result["user"] = array("name" => $row["name"], "email" => $row["email"]);
+        } else {
+          return $this->createError("This token does not exist or is no longer valid");
         }
-            $this->result["token_type"] = $res[0]["UserToken.token_type"];
-            $this->result["username"] = $res[0]["User.username"];
-            $this->result["email"] = $res[0]["User.email"];
       }
       return $this->success;
     }

core/Configuration/CreateDatabase.class.php

@@ -60,8 +60,9 @@ class CreateDatabase {
     $queries[] = $sql->createTable("UserToken")
       ->addInt("user_id")
       ->addString("token", 36)
-      ->addEnum("token_type", array("password_reset", "confirmation"))
+      ->addEnum("token_type", array("password_reset", "email_confirm"))
       ->addDateTime("valid_until")
+      ->addBool("used", false)
       ->foreignKey("user_id", "User", "uid", new CascadeStrategy());
 
     $queries[] = $sql->createTable("Group")

core/Driver/SQL/SQL.class.php

@@ -281,6 +281,7 @@ abstract class SQL {
   protected abstract function columnName($col);
 
   // Special Keywords and functions
+  public function now() { return $this->currentTimestamp(); }
   public abstract function currentTimestamp();
 
   public function count($col = NULL) {