[4.x] Security Hardening: Unset the activation token if the mail address changes (#45221)

* Unset the activation token, if the mail address changes

* strict type compare

---------

Author: SniperSister

libraries/src/User/User.php

@@ -740,6 +740,11 @@ public function save($updateOnly = false)
                 }
             }
 
+            // Unset the activation token, if the mail address changes - that affects both, activation and PW resets
+            if ($this->email !== $oldUser->email && $this->id !== 0 && !empty($this->activation) && !$this->block) {
+                $table->activation = '';
+            }
+
             // Fire the onUserBeforeSave event.
             PluginHelper::importPlugin('user');