From babd822171829c06eb5462815bb2707ac48bca74 Mon Sep 17 00:00:00 2001
From: slawkens <slawkens@gmail.com>
Date: Sun, 18 Jan 2026 21:54:08 +0100
Subject: [PATCH] New format of recovery key: xxxxx-xxxxx-xxxxx-xxxxx

TODO: adjust account lost recovery
---
 system/pages/account/base.php         | 8 ++++++++
 system/pages/account/register-new.php | 2 +-
 system/pages/account/register.php     | 2 +-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/system/pages/account/base.php b/system/pages/account/base.php
index cf497d85..7c5642cc 100644
--- a/system/pages/account/base.php
+++ b/system/pages/account/base.php
@@ -34,3 +34,11 @@ if(!$logged)
 else {
 	$show_form = true;
 }
+
+function generateRecoveryKey(): string
+{
+	return generateRandomString(5, false, true, true) . '-' .
+		generateRandomString(5, false, true, true) . '-' .
+		generateRandomString(5, false, true, true) . '-' .
+		generateRandomString(5, false, true, true);
+}
diff --git a/system/pages/account/register-new.php b/system/pages/account/register-new.php
index d328a310..caf76236 100644
--- a/system/pages/account/register-new.php
+++ b/system/pages/account/register-new.php
@@ -37,7 +37,7 @@ else
 			if($points >= setting('core.account_generate_new_reckey_price'))
 			{
 				$show_form = false;
-				$new_rec_key = generateRandomString(10, false, true, true);
+				$new_rec_key = generateRecoveryKey();
 
 				$mailBody = $twig->render('mail.account.register.html.twig', array(
 					'recovery_key' => $new_rec_key
diff --git a/system/pages/account/register.php b/system/pages/account/register.php
index 8aa3089e..bb505e66 100644
--- a/system/pages/account/register.php
+++ b/system/pages/account/register.php
@@ -27,7 +27,7 @@ if(isset($_POST['registeraccountsave']) && $_POST['registeraccountsave'] == "1")
 	if($reg_password == $account_logged->getPassword()) {
 		if(empty($old_key)) {
 			$show_form = false;
-			$new_rec_key = generateRandomString(10, false, true, true);
+			$new_rec_key = generateRecoveryKey();
 
 			$account_logged->setCustomField("key", $new_rec_key);
 			$account_logged->logAction('Generated recovery key.');