github-mirror/discourse
github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-04-27 04:54:30 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Do not sign in unapproved users (#15552)

Browse Source
This commit is contained in:
Dan Ungureanu 2022-01-13 10:42:48 +02:00 committed by GitHub
parent 909de9b36c
commit c7a6d9bc3a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
app/controllers/invites_controller.rb
View File

@ -238,17 +238,21 @@ class InvitesController < ApplicationController
return render json: failed_json.merge(message: I18n.t('invite.not_found_json')), status: 404 return render json: failed_json.merge(message: I18n.t('invite.not_found_json')), status: 404
end end
log_on_user(user) if user.active? log_on_user(user) if user.active? && user.guardian.can_access_forum?
user.update_timezone_if_missing(params[:timezone]) user.update_timezone_if_missing(params[:timezone])
post_process_invite(user) post_process_invite(user)
topic = invite.topics.first topic = invite.topics.first
response = {} response = {}
if user.present? && user.active? if user.present? && user.active? && user.guardian.can_access_forum?
response[:redirect_to] = topic.present? ? path(topic.relative_url) : path("/") response[:redirect_to] = topic.present? ? path(topic.relative_url) : path("/")
elsif user.present? elsif user.present?
response[:message] = I18n.t('invite.confirm_email') response[:message] = if user.active?
I18n.t('activation.approval_required')
else
I18n.t('invite.confirm_email')
end
cookies[:destination_url] = path(topic.relative_url) if topic.present? cookies[:destination_url] = path(topic.relative_url) if topic.present?
end end

16
spec/requests/invites_controller_spec.rb
View File

@ -447,6 +447,22 @@ describe InvitesController do
expect(response.status).to eq(412) expect(response.status).to eq(412)
end end
it 'does not log in the user if they were not approved' do
SiteSetting.must_approve_users = true
put "/invites/show/#{invite.invite_key}.json", params: { password: SecureRandom.hex, email_token: invite.email_token }
expect(session[:current_user_id]).to eq(nil)
expect(response.parsed_body["message"]).to eq(I18n.t('activation.approval_required'))
end
it 'does not log in the user if they were not activated' do
put "/invites/show/#{invite.invite_key}.json", params: { password: SecureRandom.hex }
expect(session[:current_user_id]).to eq(nil)
expect(response.parsed_body["message"]).to eq(I18n.t('invite.confirm_email'))
end
it 'fails when local login is disabled and no external auth is configured' do it 'fails when local login is disabled and no external auth is configured' do
SiteSetting.enable_local_logins = false SiteSetting.enable_local_logins = false