github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-21 18:12:32 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: prevent reuse of password reset

Browse Source
This commit is contained in:
Sam
2016-12-19 18:00:22 +11:00
parent eb2db23b40
commit e0ff57ca75
4 changed files with 50 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/controllers/application_controller.rb
View File

@ -9,6 +9,7 @@ require_dependency 'json_error'
require_dependency 'letter_avatar'
require_dependency 'distributed_cache'
require_dependency 'global_path'
require_dependency 'secure_session'
class ApplicationController < ActionController::Base
include CurrentUser
@ -381,6 +382,11 @@ class ApplicationController < ActionController::Base
end
end
def secure_session
SecureSession.new(session["secure_session_id"] ||= SecureRandom.hex)
end
private
def locale_from_header
@ -558,6 +564,7 @@ class ApplicationController < ActionController::Base
render_to_string status: status, layout: layout, formats: [:html], template: '/exceptions/not_found'
end
protected
def render_post_json(post, add_raw=true)