github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-02 04:08:41 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Delete email tokens when a user's email is changed or deleted (#19735)

Browse Source 
Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com>
This commit is contained in:
Alan Guo Xiang Tan
2023-01-05 06:08:55 +08:00
committed by GitHub
parent bf6b08670a
commit 83944213b2
3 changed files with 39 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
spec/requests/users_email_controller_spec.rb
View File

@ -242,6 +242,28 @@ RSpec.describe UsersEmailController do
end
end
end
it "destroys email tokens associated with the old email after the new email is confirmed" do
SiteSetting.enable_secondary_emails = true
email_token = user.email_tokens.create!(email: user.email, scope: EmailToken.scopes[:password_reset])
updater = EmailUpdater.new(guardian: user.guardian, user: user)
updater.change_to('bubblegum@adventuretime.ooo')
sign_in(user)
put "/u/confirm-new-email", params: {
token: "#{updater.change_req.new_email_token.token}"
}
new_password = SecureRandom.hex
put "/u/password-reset/#{email_token.token}.json", params: {
password: new_password
}
expect(response.parsed_body["success"]).to eq(false)
expect(response.parsed_body["message"]).to eq(I18n.t("password_reset.no_token", base_url: Discourse.base_url))
expect(user.reload.confirm_password?(new_password)).to eq(false)
end
end
describe '#confirm-old-email' do