DGNum/demarches-normaliennes
13
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

fix: encode reset link email in param because it's rendered in view later

Browse source
This commit is contained in:
Colin Darie 2024-02-27 18:52:59 +01:00
parent 9db7b5b864
commit 0a07c9cd72
No known key found for this signature in database
GPG key ID: 8C76CADD40253590
3 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app/controllers/application_controller.rb
View file

@ -286,7 +286,8 @@ class ApplicationController < ActionController::Base
end end
send_login_token_or_bufferize(current_instructeur) send_login_token_or_bufferize(current_instructeur)
redirect_to link_sent_path(email: current_instructeur.email) signed_email = message_verifier.generate(current_instructeur.email, purpose: :reset_link, expires_in: 1.hour)
redirect_to link_sent_path(email: signed_email)
end end
end end

10
app/controllers/users/sessions_controller.rb
View file

@ -25,12 +25,16 @@ class Users::SessionsController < Devise::SessionsController
if send_login_token_or_bufferize(current_instructeur) if send_login_token_or_bufferize(current_instructeur)
flash[:notice] = "Nous venons de vous renvoyer un nouveau lien de connexion sécurisée à #{APPLICATION_NAME}" flash[:notice] = "Nous venons de vous renvoyer un nouveau lien de connexion sécurisée à #{APPLICATION_NAME}"
end end
redirect_to link_sent_path(email: current_instructeur.email)
signed_email = message_verifier.generate(current_instructeur.email, purpose: :reset_link, expires_in: 1.hour)
redirect_to link_sent_path(email: signed_email)
end end
def link_sent def link_sent
if StrictEmailValidator::REGEXP.match?(params[:email]) email = message_verifier.verify(params[:email], purpose: :reset_link) rescue nil
@email = params[:email]
if StrictEmailValidator::REGEXP.match?(email)
@email = email
else else
redirect_to root_path redirect_to root_path
end end

4
spec/controllers/users/sessions_controller_spec.rb
View file

@ -225,7 +225,9 @@ describe Users::SessionsController, type: :controller do
describe '#link_sent' do describe '#link_sent' do
render_views render_views
before { get :link_sent, params: { email: link_email } } before { get :link_sent, params: { email: signed_email } }
let(:signed_email) { controller.message_verifier.generate(link_email, purpose: :reset_link) }
context 'when the email is legit' do context 'when the email is legit' do
let(:link_email) { 'a@a.com' } let(:link_email) { 'a@a.com' }