closes #5869

src/user/reset.js

@@ -120,12 +120,14 @@ UserReset.commit = function (code, password, callback) {
 		},
 		function (hash, next) {
 			async.parallel([
-				async.apply(user.setUserField, uid, 'password', hash),
+				async.apply(user.setUserFields, uid, { password: hash, 'email:confirmed': 1 }),
 				async.apply(db.deleteObjectField, 'reset:uid', code),
 				async.apply(db.sortedSetRemove, 'reset:issueDate', code),
 				async.apply(db.sortedSetRemove, 'reset:issueDate:uid', uid),
 				async.apply(user.reset.updateExpiry, uid),
 				async.apply(user.auth.resetLockout, uid),
+				async.apply(db.delete, 'uid:' + uid + ':confirm:email:sent'),
+				async.apply(db.sortedSetRemove, 'users:notvalidated', uid),
 			], next);
 		},
 	], callback);

test/user.js

@@ -446,15 +446,16 @@ describe('User', function () {
 			});
 		});
 
-		it('.commit() should update the user\'s password', function (done) {
+		it('.commit() should update the user\'s password and confirm their email', function (done) {
 			User.reset.commit(code, 'newpassword', function (err) {
 				assert.ifError(err);
 
-				db.getObjectField('user:' + uid, 'password', function (err, newPassword) {
+				db.getObject('user:' + uid, function (err, userData) {
 					assert.ifError(err);
-					Password.compare('newpassword', newPassword, function (err, match) {
+					Password.compare('newpassword', userData.password, function (err, match) {
 						assert.ifError(err);
 						assert(match);
+						assert.equal(parseInt(userData['email:confirmed'], 10), 1);
 						done();
 					});
 				});