Jeremy Daer 58a25c6281 End sign-in links made before a password change ...

A transfer link signed only the user id, so one copied before the
password changed still started a session for up to four hours after.
Bind it to the password salt with generates_token_for, so a new
password ends those links too. Links made before this upgrade stop
working; they last four hours at most.

From #371.

(cherry picked from commit 160ba295b5)

2026-10-19 11:37:05 -07:00

..

transfers_controller_test.rb

End sign-in links made before a password change

2026-10-19 11:37:05 -07:00