mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-28 00:16:48 +09:00
Jeremy Daer
58a25c6281
A transfer link signed only the user id, so one copied before the
password changed still started a session for up to four hours after.
Bind it to the password salt with generates_token_for, so a new
password ends those links too. Links made before this upgrade stop
working; they last four hours at most.
From #371.
(cherry picked from commit 160ba295b5)
23 lines
489 B
Ruby
23 lines
489 B
Ruby
module User::Transferable
|
|
extend ActiveSupport::Concern
|
|
|
|
TRANSFER_LINK_EXPIRY_DURATION = 4.hours
|
|
|
|
included do
|
|
# Bound to the password, so changing it also ends sign-in links made before.
|
|
generates_token_for :transfer, expires_in: TRANSFER_LINK_EXPIRY_DURATION do
|
|
password_salt&.last(10)
|
|
end
|
|
end
|
|
|
|
class_methods do
|
|
def find_by_transfer_id(id)
|
|
find_by_token_for(:transfer, id)
|
|
end
|
|
end
|
|
|
|
def transfer_id
|
|
generate_token_for(:transfer)
|
|
end
|
|
end
|