LeadMagnet/leadchat
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

chore: Fix user email re-confirmation flow (#3581)

Browse Source 
Users can change their email from profile settings. They will be logged out immediately. Users can log in again with the updated email without verifying the same. This is a security problem.

So this change enforce the user to reconfirm the email after changing it. Users can log in with the updated email only after the confirmation.

Fixes: https://huntr.dev/bounties/7afd04b4-232e-4907-8a3c-acf8bd4b5b22/
This commit is contained in:
Aswin Dev P.S
2021-12-16 06:02:49 -08:00
committed by GitHub
parent e0c9687f5e
commit 5ee209c079
6 changed files with 51 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
config/initializers/devise.rb
View File

@@ -133,7 +133,7 @@ Devise.setup do |config|
# initial account confirmation) to be applied. Requires additional unconfirmed_email
# db field (see migrations). Until confirmed, new email is stored in
# unconfirmed_email column, and copied to email column on successful confirmation.
config.reconfirmable = false
config.reconfirmable = true
# Defines which key will be used when confirming an account
# config.confirmation_keys = [:email]