#1557 Disallow player from using /email setpassword more than once

src/main/java/fr/xephi/authme/command/CommandInitializer.java

@@ -33,9 +33,9 @@ import fr.xephi.authme.command.executable.changepassword.ChangePasswordCommand;
 import fr.xephi.authme.command.executable.email.AddEmailCommand;
 import fr.xephi.authme.command.executable.email.ChangeEmailCommand;
 import fr.xephi.authme.command.executable.email.EmailBaseCommand;
+import fr.xephi.authme.command.executable.email.EmailSetPasswordCommand;
 import fr.xephi.authme.command.executable.email.ProcessCodeCommand;
 import fr.xephi.authme.command.executable.email.RecoverEmailCommand;
-import fr.xephi.authme.command.executable.email.SetPasswordCommand;
 import fr.xephi.authme.command.executable.email.ShowEmailCommand;
 import fr.xephi.authme.command.executable.login.LoginCommand;
 import fr.xephi.authme.command.executable.logout.LogoutCommand;
@@ -540,7 +540,7 @@ public class CommandInitializer {
             .detailedDescription("Set a new password after successfully recovering your account.")
             .withArgument("password", "New password", MANDATORY)
             .permission(PlayerPermission.RECOVER_EMAIL)
-            .executableCommand(SetPasswordCommand.class)
+            .executableCommand(EmailSetPasswordCommand.class)
             .register();
 
         return emailBase;

src/main/java/fr/xephi/authme/command/executable/email/EmailSetPasswordCommand.java

@@ -18,7 +18,7 @@ import java.util.List;
 /**
  * Command for changing password following successful recovery.
  */
-public class SetPasswordCommand extends PlayerCommand {
+public class EmailSetPasswordCommand extends PlayerCommand {
 
     @Inject
     private DataSource dataSource;
@@ -45,11 +45,14 @@ public class SetPasswordCommand extends PlayerCommand {
             if (!result.hasError()) {
                 HashedPassword hashedPassword = passwordSecurity.computeHash(password, name);
                 dataSource.updatePassword(name, hashedPassword);
+                recoveryService.removeFromSuccessfulRecovery(player);
                 ConsoleLogger.info("Player '" + name + "' has changed their password from recovery");
                 commonService.send(player, MessageKey.PASSWORD_CHANGED_SUCCESS);
             } else {
                 commonService.send(player, result.getMessageKey(), result.getArgs());
             }
+        } else {
+            commonService.send(player, MessageKey.CHANGE_PASSWORD_EXPIRED);
         }
     }
 }

src/main/java/fr/xephi/authme/service/PasswordRecoveryService.java

@@ -121,6 +121,16 @@ public class PasswordRecoveryService implements Reloadable, HasCleanup {
         commonService.send(player, MessageKey.RECOVERY_CHANGE_PASSWORD);
     }
 
+    /**
+     * Removes a player from the list of successful recovers so that he can
+     * no longer use the /email setpassword command.
+     *
+     * @param player The player to remove.
+     */
+    public void removeFromSuccessfulRecovery(Player player) {
+        successfulRecovers.remove(player.getName());
+    }
+
     /**
      * Check if a player is able to have emails sent.
      *
@@ -149,12 +159,7 @@ public class PasswordRecoveryService implements Reloadable, HasCleanup {
         String playerAddress = PlayerUtils.getPlayerIp(player);
         String storedAddress = successfulRecovers.get(name);
 
-        if (storedAddress == null || !playerAddress.equals(storedAddress)) {
-            messages.send(player, MessageKey.CHANGE_PASSWORD_EXPIRED);
-            return false;
-        }
-
-        return true;
+        return storedAddress != null && playerAddress.equals(storedAddress);
     }
 
     @Override