FIX: When admin changes another user's email auto-confirm the change (#9001)

When admin changes a user's email from the preferences page of that user:

* The user will not be sent an email to confirm that their
  email is changing. They will be sent a reset password email
  so they can set the password for their account at the new
  email address.
* The user will still be sent an email to their old email to inform
  them that it was changed.
* Admin and staff users still need to follow the same old + new
  confirm process, as do users changing their own email.
This commit is contained in:
Martin Brennan
2020-02-20 09:52:21 +10:00
committed by GitHub
parent 20b90afad9
commit 97d8f19387
5 changed files with 131 additions and 21 deletions

View File

@ -35,7 +35,7 @@ class UsersEmailController < ApplicationController
RateLimiter.new(user, "change-email-hr-#{request.remote_ip}", 6, 1.hour).performed!
RateLimiter.new(user, "change-email-min-#{request.remote_ip}", 3, 1.minute).performed!
updater = EmailUpdater.new(guardian, user)
updater = EmailUpdater.new(guardian: guardian, user: user, initiating_user: current_user)
updater.change_to(params[:email])
if updater.errors.present?
@ -60,7 +60,7 @@ class UsersEmailController < ApplicationController
if !@error
# this is needed becase the form posts this field as JSON and it can be a
# hash when authenticatong security key.
# hash when authenticating security key.
if params[:second_factor_method].to_i == UserSecondFactor.methods[:security_key]
begin
params[:second_factor_token] = JSON.parse(params[:second_factor_token])