Prevent CSRF bypass with password reset form

2021-02-09 22:59:54 +00:00 · 2021-02-09 22:59:54 +00:00 · 51af102c00
commit 51af102c00
parent c49e400aa3
2 changed files with 11 additions and 1 deletions
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@ -151,7 +151,7 @@ class UsersController < ApplicationController
  def lost_password
    @title = t "users.lost_password.title"

-    if params[:email]
+    if request.post?
      user = User.visible.find_by(:email => params[:email])

      if user.nil?