get token from req.params

src/server/middlewares/password-reset.js

@@ -2,7 +2,7 @@ module.exports = (crowi, app) => {
   const PasswordResetOrder = crowi.model('PasswordResetOrder');
 
   return async(req, res, next) => {
-    const { token } = req.query;
+    const { token } = req.params;
 
     if (token == null) {
       return res.redirect('/login');

src/server/routes/forgot-password.js

@@ -40,7 +40,7 @@ module.exports = function(crowi, app) {
 
     try {
       const passwordResetOrderData = await PasswordResetOrder.createPasswordResetOrder(email);
-      const url = new URL(`/forgot-password/reset-password?email=${email}&token=${passwordResetOrderData.token}`, appUrl);
+      const url = new URL(`/forgot-password/${passwordResetOrderData.token}`, appUrl);
       const oneTimeUrl = url.href;
       await sendPasswordResetEmail(email, oneTimeUrl, i18n);
       return res.json(ApiResponse.success());