Added another level of check on the reset password key.

src/IDF/Form/PasswordInputKey.php

@@ -95,6 +95,10 @@ class IDF_Form_PasswordInputKey extends Pluf_Form
             return false;
         }
         $cr = new Pluf_Crypt(md5(Pluf::f('secret_key')));
-        return split(':', $cr->decrypt($encrypted), 3);
+        $f = split(':', $cr->decrypt($encrypted), 3);
+        if (count($f) != 3) {
+            return false;
+        }
+        return $f;
     }
 }