meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2026-01-04 22:59:47 +00:00
Code Issues Releases Wiki Activity

Redirect with token in session (#24416).

Browse Source 
git-svn-id: http://svn.redmine.org/redmine/trunk@16287 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2017-01-29 08:58:40 +00:00
parent 427a745184
commit 9e1723c537
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
app/controllers/account_controller.rb
View File

@ -60,12 +60,20 @@ class AccountController < ApplicationController
# Lets user choose a new password
def lost_password
(redirect_to(home_url); return) unless Setting.lost_password?
if params[:token]
@token = Token.find_token("recovery", params[:token].to_s)
if prt = (params[:token] || session[:password_recovery_token])
@token = Token.find_token("recovery", prt.to_s)
if @token.nil? || @token.expired?
redirect_to home_url
return
end
# redirect to remove the token query parameter from the URL and add it to the session
if request.query_parameters[:token].present?
session[:password_recovery_token] = @token.value
redirect_to lost_password_url
return
end
@user = @token.user
unless @user && @user.active?
redirect_to home_url