public function validateToken($sCode, $bGenerateNewPw)
    {
        if (empty($sCode)) {
            return false;
        }

        // --------------------------------------------------------------------------

        $oDb = Factory::service('Database');
        $oDb->select('id, group_id, forgotten_password_code');
        $oDb->like('forgotten_password_code', ':' . $sCode, 'before');
        $oResult = $oDb->get(NAILS_DB_PREFIX . 'user');

        // --------------------------------------------------------------------------

        if ($oResult->num_rows() != 1) {
            return false;
        }

        // --------------------------------------------------------------------------

        $oUser = $oResult->row();
        $aCode = explode(':', $oUser->forgotten_password_code);

        // --------------------------------------------------------------------------

        //  Check that the link is still valid
        if (time() > $aCode[0]) {

            return 'EXPIRED';

        } else {

            //  Valid hash and hasn't expired.
            $aOut            = [];
            $aOut['user_id'] = $oUser->id;

            //  Generate a new password?
            if ($bGenerateNewPw) {

                $aOut['password'] = $this->generate($oUser->group_id);

                if (empty($aOut['password'])) {
                    //  This should never happen, but just in case.
                    return false;
                }

                $oHash = $this->generateHash($oUser->group_id, $aOut['password']);

                if (!$oHash) {
                    //  Again, this should never happen, but just in case.
                    return false;
                }

                // --------------------------------------------------------------------------

                $aData['password']                = $oHash->password;
                $aData['password_md5']            = $oHash->password_md5;
                $aData['password_engine']         = $oHash->engine;
                $aData['salt']                    = $oHash->salt;
                $aData['temp_pw']                 = true;
                $aData['forgotten_password_code'] = null;

                $oDb->where('forgotten_password_code', $oUser->forgotten_password_code);
                $oDb->set($aData);
                $oDb->update(NAILS_DB_PREFIX . 'user');
            }
        }

        return $aOut;
    }