Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-12-17 22:10:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: #10236, don't check email:uid, instead verify an email confirmation is active

Browse Source
This commit is contained in:
Julian Lam
2022-02-03 15:41:40 -05:00
parent c5637d1527
commit 0322e984e0
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/controllers/write/users.js
View File

@@ -265,8 +265,8 @@ Users.getEmail = async (req, res) => {
}; };
Users.confirmEmail = async (req, res) => { Users.confirmEmail = async (req, res) => {
const [exists, canManage] = await Promise.all([ const [pending, canManage] = await Promise.all([
db.isSortedSetMember('email:uid', req.params.email.toLowerCase()), user.email.isValidationPending(req.params.uid, req.params.email),
privileges.admin.can('admin:users', req.uid), privileges.admin.can('admin:users', req.uid),
]); ]);
@@ -274,8 +274,9 @@ Users.confirmEmail = async (req, res) => {
helpers.notAllowed(req, res); helpers.notAllowed(req, res);
} }
if (exists) { if (pending) {
await user.email.confirmByUid(req.params.uid); const code = await db.get(`confirm:byUid:${req.params.uid}`);
await user.email.confirmByCode(code, req.session.id);
helpers.formatApiResponse(200, res); helpers.formatApiResponse(200, res);
} else { } else {
helpers.formatApiResponse(404, res); helpers.formatApiResponse(404, res);