From 9b14b96abc40ada081790d1486883f037a947439 Mon Sep 17 00:00:00 2001
From: gumi <git@gumi.ca>
Date: Sun, 26 May 2019 13:39:51 -0400
Subject: tell players to contact staff if they believe they've been hacked

---
 src/routers/tmwa/middlewares/account.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/routers/tmwa/middlewares/account.js b/src/routers/tmwa/middlewares/account.js
index 0ba1010..1c7d0da 100644
--- a/src/routers/tmwa/middlewares/account.js
+++ b/src/routers/tmwa/middlewares/account.js
@@ -201,7 +201,7 @@ const reset_password = async (req, res, next) => {
         const uuid = uuidv4();
         transporter.sendMail({
             from: req.app.locals.mailer.from,
-            to: email,
+            to: req.body.email,
             subject: "The Mana World password reset",
             text: "You are receiving this email because someone (you?) has requested a password reset on The Mana World"+
                    "with your email address.\nIf you did not request a password reset please ignore this email.\n\n"+
@@ -306,9 +306,9 @@ const reset_password = async (req, res, next) => {
 
                 transporter.sendMail({
                     from: req.app.locals.mailer.from,
-                    to: email,
+                    to: account.email,
                     subject: "The Mana World password reset",
-                    text: `You have successfully reset the password for account \"${req.body.username}\".\nHave fun playing The Mana World!`
+                    text: `You have successfully reset the password for account \"${req.body.username}\".\nHave fun playing The Mana World!\n\n⚠ If you did not perform this password reset, please contact us ASAP to secure your account.`
                 }, (err, info) => {
                     req.app.locals.logger.info(`TMWA.account: sent password reset confirmation email: ${req.body.username} ${info.messageId}`);
                 });
-- 
cgit v1.2.3-60-g2f50