fix: correct order when consuming password reset token

diff --git a/src/org/cacert/gigi/dbObjects/User.java b/src/org/cacert/gigi/dbObjects/User.java
index a77898662f43b819b85d0a89d08f2667ecb92ea2..e6afc79666c60f1cf07540b893f08d309a3a4b3a 100644 (file)
--- a/src/org/cacert/gigi/dbObjects/User.java
+++ b/src/org/cacert/gigi/dbObjects/User.java
@@ -512,13 +512,13 @@ public class User extends CertificateOwner {
             if ( !rs.next()) {
                 throw new GigiApiException("Token not found... very bad.");
             }
-            ps = DatabaseConnection.getInstance().prepare("UPDATE `passwordResetTickets` SET  `used` = CURRENT_TIMESTAMP WHERE `id`=?");
-            ps.setInt(1, id);
-            ps.executeUpdate();
             if (PasswordHash.verifyHash(private_token, rs.getString(1)) == null) {
                 throw new GigiApiException("Private token does not match.");
             }
             setPassword(newPassword);
+            ps = DatabaseConnection.getInstance().prepare("UPDATE `passwordResetTickets` SET  `used` = CURRENT_TIMESTAMP WHERE `id`=?");
+            ps.setInt(1, id);
+            ps.executeUpdate();
         }
     }