IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 20:18:23 -05:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Prevent abuse of the update_activation_email route (#17694)

Browse Source
This commit is contained in:
Roman Rizzi
2022-07-27 17:04:42 -03:00
committed by GitHub
parent 7b1ff41716
commit 7c73e896ce
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/users_controller.rb
+2
View File
@@ -1108,10 +1108,12 @@ class UsersController < ApplicationController
RateLimiter.new(nil, "activate-edit-email-hr-#{request.remote_ip}", 5, 1.hour).performed!
if params[:username].present?
RateLimiter.new(nil, "activate-edit-email-hr-username-#{params[:username]}", 5, 1.hour).performed!
@user = User.find_by_username_or_email(params[:username])
raise Discourse::InvalidAccess.new unless @user.present?
raise Discourse::InvalidAccess.new unless @user.confirm_password?(params[:password])
elsif user_key = session[SessionController::ACTIVATE_USER_KEY]
RateLimiter.new(nil, "activate-edit-email-hr-user-key-#{user_key}", 5, 1.hour).performed!
@user = User.where(id: user_key.to_i).first
end