From 57a4fedd346a50d36760d689a4bcaa8e17f71d3c Mon Sep 17 00:00:00 2001 From: Go MAEDA Date: Sun, 28 Oct 2018 05:59:11 +0000 Subject: Handles the case when an expired token is in the users session (#29781). MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Patch by Jens Krämer. git-svn-id: http://svn.redmine.org/redmine/trunk@17601 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/controllers/account_controller.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'app/controllers') diff --git a/app/controllers/account_controller.rb b/app/controllers/account_controller.rb index 7bb644761..f604540a7 100644 --- a/app/controllers/account_controller.rb +++ b/app/controllers/account_controller.rb @@ -62,9 +62,15 @@ class AccountController < ApplicationController (redirect_to(home_url); return) unless Setting.lost_password? if prt = (params[:token] || session[:password_recovery_token]) @token = Token.find_token("recovery", prt.to_s) - if @token.nil? || @token.expired? + if @token.nil? redirect_to home_url return + elsif @token.expired? + # remove expired token from session and let user try again + session[:password_recovery_token] = nil + flash[:error] = l(:error_token_expired) + redirect_to lost_password_url + return end # redirect to remove the token query parameter from the URL and add it to the session -- cgit v1.2.3