github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-31 21:55:25 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Disable access to "activate-account" route for existing users

Browse Source
This commit is contained in:
Penar Musaraj
2024-12-27 13:42:03 -05:00
committed by Roman Rizzi
parent 17116c440b
commit b89cf9b443
5 changed files with 39 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
config/routes.rb
View File

@ -597,11 +597,17 @@ Discourse::Application.routes.draw do
format: "json",
}
put "#{root_path}/password-reset/:token" => "users#password_reset_update"
get "#{root_path}/activate-account/:token" => "users#activate_account"
get "#{root_path}/activate-account/:token" => "users#activate_account",
:constraints => {
token: /[0-9a-f]+/,
}
put(
{ "#{root_path}/activate-account/:token" => "users#perform_account_activation" }.merge(
index == 1 ? { as: "perform_activate_account" } : {},
),
{
"#{root_path}/activate-account/:token" => "users#perform_account_activation",
:constraints => {
token: /[0-9a-f]+/,
},
}.merge(index == 1 ? { as: "perform_activate_account" } : {}),
)
get "#{root_path}/confirm-old-email/:token" => "users_email#show_confirm_old_email"