github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 07:53:49 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Prevent users from updating to blacklisted email domains

Browse Source
This commit is contained in:
Robin Ward
2017-09-12 10:03:33 -04:00
parent 85ef3696de
commit 171d9e5aed
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/controllers/users_controller.rb
View File

@ -619,9 +619,12 @@ class UsersController < ApplicationController
raise Discourse::InvalidAccess.new if current_user.present?
User.transaction do
@user.email = params[:email]
primary_email = @user.primary_email
if @user.save
primary_email.email = params[:email]
primary_email.should_validate_email = true
if primary_email.save
@user.email_tokens.create(email: @user.email)
enqueue_activation_email
render json: success_json