From a170c3d93c955242908815bd7e5b013334befde4 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Sun, 29 Jan 2017 10:42:58 +0000 Subject: Merged r16287 to r16289 (#24416). git-svn-id: http://svn.redmine.org/redmine/branches/3.2-stable@16299 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/controllers/account_controller.rb | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'app/controllers') diff --git a/app/controllers/account_controller.rb b/app/controllers/account_controller.rb index 504ca6013..10516bc8c 100644 --- a/app/controllers/account_controller.rb +++ b/app/controllers/account_controller.rb @@ -58,12 +58,20 @@ class AccountController < ApplicationController # Lets user choose a new password def lost_password (redirect_to(home_url); return) unless Setting.lost_password? - if params[:token] - @token = Token.find_token("recovery", params[:token].to_s) + if prt = (params[:token] || session[:password_recovery_token]) + @token = Token.find_token("recovery", prt.to_s) if @token.nil? || @token.expired? redirect_to home_url return end + + # redirect to remove the token query parameter from the URL and add it to the session + if request.query_parameters[:token].present? + session[:password_recovery_token] = @token.value + redirect_to lost_password_url + return + end + @user = @token.user unless @user && @user.active? redirect_to home_url -- cgit v1.2.3