cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Delete any outstanding tokens when a user changes their email

Browse source 
This ensures that any tokens previously sent to the old email address
can no longer be used if somebody were able to access that address.
This commit is contained in:
Tom Hughes 2020-09-29 13:47:40 +01:00
parent f0bf85d4a1
commit c694c78c9a
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/users_controller.rb
View file

@ -366,7 +366,7 @@ class UsersController < ApplicationController
else else
flash[:errors] = current_user.errors flash[:errors] = current_user.errors
end end
token.destroy current_user.tokens.delete_all
session[:user] = current_user.id session[:user] = current_user.id
redirect_to :action => "account", :display_name => current_user.display_name redirect_to :action => "account", :display_name => current_user.display_name
elsif token elsif token

2
app/models/user.rb
View file

@ -56,7 +56,7 @@ class User < ApplicationRecord
has_many :sent_messages, -> { where(:from_user_visible => true).order(:sent_on => :desc).preload(:sender, :recipient) }, :class_name => "Message", :foreign_key => :from_user_id has_many :sent_messages, -> { where(:from_user_visible => true).order(:sent_on => :desc).preload(:sender, :recipient) }, :class_name => "Message", :foreign_key => :from_user_id
has_many :friendships, -> { joins(:befriendee).where(:users => { :status => %w[active confirmed] }) } has_many :friendships, -> { joins(:befriendee).where(:users => { :status => %w[active confirmed] }) }
has_many :friends, :through => :friendships, :source => :befriendee has_many :friends, :through => :friendships, :source => :befriendee
has_many :tokens, :class_name => "UserToken" has_many :tokens, :class_name => "UserToken", :dependent => :destroy
has_many :preferences, :class_name => "UserPreference" has_many :preferences, :class_name => "UserPreference"
has_many :changesets, -> { order(:created_at => :desc) } has_many :changesets, -> { order(:created_at => :desc) }
has_many :changeset_comments, :foreign_key => :author_id has_many :changeset_comments, :foreign_key => :author_id