github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-23 09:22:42 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Add confirmation screen when connecting associated accounts

Browse Source
This commit is contained in:
David Taylor
2019-07-17 12:34:02 +01:00
parent da4c1c5afc
commit 0a6cae654b
15 changed files with 235 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
app/controllers/users/omniauth_callbacks_controller.rb
View File

@ -28,20 +28,10 @@ class Users::OmniauthCallbacksController < ApplicationController
provider = DiscoursePluginRegistry.auth_providers.find { |p| p.name == params[:provider] }
if session.delete(:auth_reconnect) && authenticator.can_connect_existing_user? && current_user
# If we're reconnecting, don't actually try and log the user in
@auth_result = authenticator.after_authenticate(auth, existing_account: current_user)
if provider&.full_screen_login || cookies['fsl']
cookies.delete('fsl')
DiscourseEvent.trigger(:after_auth, authenticator, @auth_result)
return redirect_to Discourse.base_uri("/my/preferences/account")
else
@auth_result.authenticated = true
DiscourseEvent.trigger(:after_auth, authenticator, @auth_result)
return respond_to do |format|
format.html
format.json { render json: @auth_result.to_client_hash }
end
end
# Save to redis, with a secret token, then redirect to confirmation screen
token = SecureRandom.hex
$redis.setex "#{Users::AssociateAccountsController::REDIS_PREFIX}_#{current_user.id}_#{token}", 10.minutes, auth.to_json
return redirect_to Discourse.base_uri("/associate/#{token}")
else
@auth_result = authenticator.after_authenticate(auth)
DiscourseEvent.trigger(:after_auth, authenticator, @auth_result)