diff options
author | Patrick Figel <patrick@figel.email> | 2018-01-02 16:55:00 +0100 |
---|---|---|
committer | Eugen Rochko <eugen@zeonfederated.com> | 2018-01-02 16:55:00 +0100 |
commit | 04ecf44c2f78ae29911027352a3e9fb21187e20c (patch) | |
tree | b7cd1393ef5c0a938d5c928327f563f4bb206290 /app | |
parent | b6af88192ff48372c5f6ed1321f21d99aaffcd3f (diff) |
Add confirmation step for email changes (#6071)
* Add confirmation step for email changes
This adds a confirmation step for email changes of existing users.
Like the initial account confirmation, a confirmation link is sent
to the new address.
Additionally, a notification is sent to the existing address when
the change is initiated. This message includes instruction to reset
the password immediately or to contact the instance admin if the
change was not initiated by the account owner.
Fixes #3871
* Add review fixes
Diffstat (limited to 'app')
-rw-r--r-- | app/controllers/auth/registrations_controller.rb | 4 | ||||
-rw-r--r-- | app/mailers/user_mailer.rb | 15 | ||||
-rw-r--r-- | app/models/user.rb | 11 | ||||
-rw-r--r-- | app/views/user_mailer/email_changed.en.html.erb | 15 | ||||
-rw-r--r-- | app/views/user_mailer/email_changed.en.text.erb | 13 | ||||
-rw-r--r-- | app/views/user_mailer/reconfirmation_instructions.en.html.erb | 15 | ||||
-rw-r--r-- | app/views/user_mailer/reconfirmation_instructions.en.text.erb | 12 |
7 files changed, 80 insertions, 5 deletions
diff --git a/app/controllers/auth/registrations_controller.rb b/app/controllers/auth/registrations_controller.rb index da0b6512f28..b8ff4e54f28 100644 --- a/app/controllers/auth/registrations_controller.rb +++ b/app/controllers/auth/registrations_controller.rb @@ -37,6 +37,10 @@ class Auth::RegistrationsController < Devise::RegistrationsController new_user_session_path end + def after_update_path_for(_resource) + edit_user_registration_path + end + def check_enabled_registrations redirect_to root_path if single_user_mode? || !allowed_registrations? end diff --git a/app/mailers/user_mailer.rb b/app/mailers/user_mailer.rb index 5a062dc2574..7821be32b2e 100644 --- a/app/mailers/user_mailer.rb +++ b/app/mailers/user_mailer.rb @@ -13,7 +13,9 @@ class UserMailer < Devise::Mailer return if @resource.disabled? I18n.with_locale(@resource.locale || I18n.default_locale) do - mail to: @resource.unconfirmed_email.blank? ? @resource.email : @resource.unconfirmed_email, subject: I18n.t('devise.mailer.confirmation_instructions.subject', instance: @instance) + mail to: @resource.unconfirmed_email.blank? ? @resource.email : @resource.unconfirmed_email, + subject: I18n.t(@resource.pending_reconfirmation? ? 'devise.mailer.reconfirmation_instructions.subject' : 'devise.mailer.confirmation_instructions.subject', instance: @instance), + template_name: @resource.pending_reconfirmation? ? 'reconfirmation_instructions' : 'confirmation_instructions' end end @@ -39,4 +41,15 @@ class UserMailer < Devise::Mailer mail to: @resource.email, subject: I18n.t('devise.mailer.password_change.subject') end end + + def email_changed(user, **) + @resource = user + @instance = Rails.configuration.x.local_domain + + return if @resource.disabled? + + I18n.with_locale(@resource.locale || I18n.default_locale) do + mail to: @resource.email, subject: I18n.t('devise.mailer.email_changed.subject') + end + end end diff --git a/app/models/user.rb b/app/models/user.rb index 3ce6517a65b..a82a7d28a0e 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -41,12 +41,15 @@ class User < ApplicationRecord ACTIVE_DURATION = 14.days - devise :registerable, :recoverable, - :rememberable, :trackable, :validatable, :confirmable, - :two_factor_authenticatable, :two_factor_backupable, - otp_secret_encryption_key: ENV['OTP_SECRET'], + devise :two_factor_authenticatable, + otp_secret_encryption_key: ENV['OTP_SECRET'] + + devise :two_factor_backupable, otp_number_of_backup_codes: 10 + devise :registerable, :recoverable, :rememberable, :trackable, :validatable, + :confirmable + belongs_to :account, inverse_of: :user, required: true belongs_to :invite, counter_cache: :uses accepts_nested_attributes_for :account diff --git a/app/views/user_mailer/email_changed.en.html.erb b/app/views/user_mailer/email_changed.en.html.erb new file mode 100644 index 00000000000..c1068008656 --- /dev/null +++ b/app/views/user_mailer/email_changed.en.html.erb @@ -0,0 +1,15 @@ +<p>Hello <%= @resource.email %>!</p> + +<% if @resource&.unconfirmed_email? %> + <p>We're contacting you to notify you that the email you use on <%= @instance %> is being changed to <%= @resource.unconfirmed_email %>.</p> +<% else %> + <p>We're contacting you to notify you that the email you use on <%= @instance %> has been changed to <%= @resource.email %>.</p> +<% end %> + +<p> + If you did not change your email, it is likely that someone has gained access to your account. Please change your password immediately or contact the instance admin if you're locked out of your account. +</p> + +<p>Sincerely,<p> + +<p>The <%= @instance %> team</p> diff --git a/app/views/user_mailer/email_changed.en.text.erb b/app/views/user_mailer/email_changed.en.text.erb new file mode 100644 index 00000000000..97197246118 --- /dev/null +++ b/app/views/user_mailer/email_changed.en.text.erb @@ -0,0 +1,13 @@ +Hello <%= @resource.email %>! + +<% if @resource&.unconfirmed_email? %> +We're contacting you to notify you that the email you use on <%= @instance %> is being changed to <%= @resource.unconfirmed_email %>. +<% else %> +We're contacting you to notify you that the email you use on <%= @instance %> has been changed to <%= @resource.email %>. +<% end %> + +If you did not change your email, it is likely that someone has gained access to your account. Please change your password immediately or contact the instance admin if you're locked out of your account. + +Sincerely, + +The <%= @instance %> team diff --git a/app/views/user_mailer/reconfirmation_instructions.en.html.erb b/app/views/user_mailer/reconfirmation_instructions.en.html.erb new file mode 100644 index 00000000000..31866a3c84e --- /dev/null +++ b/app/views/user_mailer/reconfirmation_instructions.en.html.erb @@ -0,0 +1,15 @@ +<p>Hello <%= @resource.unconfirmed_email %>!</p> + +<p>You requested a change to the email address you use on <%= @instance %>.</p> + +<p>To confirm your new email, please click on the following link:<br> +<%= link_to 'Confirm my email address', confirmation_url(@resource, confirmation_token: @token) %></p> + +<p>If the above link did not work, copy and paste this URL into your address bar: <br> +<span><%= confirmation_url(@resource, confirmation_token: @token) %></span> + +<p>Please also check out our <%= link_to 'terms and conditions', terms_url %>.</p> + +<p>Sincerely,<p> + +<p>The <%= @instance %> team</p> diff --git a/app/views/user_mailer/reconfirmation_instructions.en.text.erb b/app/views/user_mailer/reconfirmation_instructions.en.text.erb new file mode 100644 index 00000000000..c1c735b3ac9 --- /dev/null +++ b/app/views/user_mailer/reconfirmation_instructions.en.text.erb @@ -0,0 +1,12 @@ +Hello <%= @resource.unconfirmed_email %>! + +You requested a change to the email address you use on <%= @instance %>. + +To confirm your new email, please click on the following link: +<%= confirmation_url(@resource, confirmation_token: @token) %> + +Please also check out our terms and conditions <%= terms_url %> + +Sincerely, + +The <%= @instance %> team |