github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-23 07:30:16 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: always allow staff to resend activation mails

Browse Source
This commit is contained in:
Sam 2017-03-13 10:32:24 -04:00
parent 1a745ca16a
commit a690121805
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/users_controller.rb
View File

@ -571,7 +571,7 @@ class UsersController < ApplicationController
raise Discourse::NotFound unless @user raise Discourse::NotFound unless @user
if (current_user && !current_user.staff?) || if !current_user&.staff? &&
@user.id != session[SessionController::ACTIVATE_USER_KEY] @user.id != session[SessionController::ACTIVATE_USER_KEY]
raise Discourse::InvalidAccess raise Discourse::InvalidAccess

8
spec/controllers/users_controller_spec.rb
View File

@ -1423,9 +1423,15 @@ describe UsersController do
it 'should not be valid' do it 'should not be valid' do
user = Fabricate(:user) user = Fabricate(:user)
xhr :post, :send_activation_email, username: user.username xhr :post, :send_activation_email, username: user.username
expect(response.status).to eq(403) expect(response.status).to eq(403)
end end
it 'should allow staff regardless' do
log_in :admin
user = Fabricate(:user, active: false)
xhr :post, :send_activation_email, username: user.username
expect(response.status).to eq(200)
end
end end
context 'with a valid email_token' do context 'with a valid email_token' do