mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-28 00:16:48 +09:00
Jeremy Daer
b01bb7a0a7
Keeping the session the password was changed from also kept any copy of its cookie working, and a copied cookie is one of the ways someone else gets into an account. Every session ends now, and the profile page signs the browser that changed the password back in with a new one.
29 lines
720 B
Ruby
29 lines
720 B
Ruby
class Users::ProfilesController < ApplicationController
|
|
before_action :set_user
|
|
|
|
def show
|
|
@direct_memberships, @shared_memberships =
|
|
Current.user.memberships.with_ordered_room.partition { |m| m.room.direct? }
|
|
end
|
|
|
|
def update
|
|
@user.update user_params
|
|
start_new_session_for @user if @user.saved_change_to_password_digest?
|
|
|
|
redirect_to user_profile_url, notice: update_notice
|
|
end
|
|
|
|
private
|
|
def set_user
|
|
@user = Current.user
|
|
end
|
|
|
|
def user_params
|
|
params.require(:user).permit(:name, :avatar, :email_address, :password, :bio).compact
|
|
end
|
|
|
|
def update_notice
|
|
params[:user][:avatar] ? "It may take up to 30 minutes to change everywhere." : "✓"
|
|
end
|
|
end
|