cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't allow deleted users to be confirmed

Browse source
This commit is contained in:
Tom Hughes 2021-04-01 17:23:43 +01:00
parent 5861bfb8f2
commit e0d501f832
2 changed files with 42 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/users_controller.rb
View file

@ -280,6 +280,8 @@ class UsersController < ApplicationController
elsif !token || token.expired?
flash[:error] = t("users.confirm.unknown token")
redirect_to :action => "confirm"
elsif !token.user.visible?
render_unknown_user token.user.display_name
else
user = token.user
user.status = "active"
@ -309,14 +311,14 @@ class UsersController < ApplicationController
end
end
else
user = User.find_by(:display_name => params[:display_name])
user = User.visible.find_by(:display_name => params[:display_name])
redirect_to root_path if user.nil? || user.active?
end
end
def confirm_resend
user = User.find_by(:display_name => params[:display_name])
user = User.visible.find_by(:display_name => params[:display_name])
token = UserToken.find_by(:token => session[:token])
if user.nil? || token.nil? || token.user != user