Add 12 hour expiry to email verification tokens

app/blueprints/users/account.py

@@ -316,6 +316,14 @@ def verify_email():
 		flash("Unknown verification token!", "danger")
 		return redirect(url_for("homepage.home"))
 
+	delta = (datetime.datetime.now() - ver.created_at)
+	delta: datetime.timedelta
+	if delta.total_seconds() > 12*60*60:
+		flash("Token has expired", "danger")
+		db.session.delete(ver)
+		db.session.commit()
+		return redirect(url_for("homepage.home"))
+
 	user = ver.user
 
 	addAuditLog(AuditSeverity.USER, user, "Confirmed their email",

app/flatpages/email_sent.md

@@ -4,4 +4,6 @@ toc: False
 We've sent an email to the address you specified.
 You'll need to click the link in the email to confirm it
 
+**The link will expire in 12 hours**
+
 <a class="btn btn-secondary" href="/help/faq/#my-verification-email-never-arrived">My email never arrived</a>