Add a password reset cooldown

src/config/GeneralConfig.php

@@ -2026,6 +2026,20 @@ class GeneralConfig extends BaseConfig
      */
     public string $partialTemplatesPath = '_partials';
 
+    /**
+     * @var int The duration in seconds of the cooldown timer after a reset password mail has been sent.
+     *
+     * Prevents other from exploiting the reset password functionality by applying a phase within it is not possible to
+     * trigger another password reset mail. Set the duration to zero to disable the cooldown.
+     *
+     * ::: code
+     * ```php Static Config
+     * ->passwordResetCooldownDuration(300)
+     * ```
+     * :::
+     */
+    public int $passwordResetCooldownDuration = 60;
+
     /**
      * @var string|null The query string param that Craft will check when determining the request’s path.
      *
@@ -5553,6 +5567,27 @@ public function pageTrigger(string $value): self
         return $this;
     }
 
+
+    /**
+     * The duration in seconds of the cooldown timer after a reset password mail has been sent.
+     *
+     * Prevents other from exploiting the reset password functionality by applying a phase within it is not possible to
+     * trigger another password reset mail. Set the duration to zero to disable the cooldown.
+     *
+     * ```php
+     * ->passwordResetCooldownDuration(300)
+     * ```
+     *
+     * @param int $value
+     * @return self
+     * @see $passwordResetCooldownDuration
+     */
+    public function passwordResetCooldownDuration(int $value): self
+    {
+        $this->passwordResetCooldownDuration = $value;
+        return $this;
+    }
+
     /**
      * The path within the `templates` folder where element partial templates will live.
      *

src/services/Users.php

@@ -482,9 +482,25 @@ public function sendNewEmailVerifyEmail(User $user): bool
      * @param User $user The user to send the forgot password email to.
      * @return bool Whether the email was sent successfully.
      * @throws InvalidElementException if the user doesn't validate
+     * @throws UserNotFoundException if the user is invalid
      */
     public function sendPasswordResetEmail(User $user): bool
     {
+        $cooldown = Craft::$app->getConfig()->getGeneral()->passwordResetCooldownDuration;
+        if ($cooldown > 0) {
+            $userRecord = $this->_getUserRecordById($user->id);
+            $issuedAtRaw = $userRecord->verificationCodeIssuedDate;
+
+            if ($issuedAtRaw) {
+                $issuedAt = new DateTime($issuedAtRaw, new DateTimeZone('UTC'));
+                $elapsed = time() - $issuedAt->getTimestamp();
+
+                if ($elapsed < $cooldown) {
+                    throw new \Exception('Password reset cooldown active');
+                }
+            }
+        }
+
         $url = $this->getPasswordResetUrl($user);
 
         return Craft::$app->getMailer()