users: refactor password reset flow.
The old password reset flow: * User requests a password reset. * Danbooru generates a password reset nonce. * Danbooru emails user a password reset confirmation link. * User follows link to password reset confirmation page. * The link contains a nonce authenticating the user. * User confirms password reset. * Danbooru resets user's password to a random string. * Danbooru emails user their new password in plaintext. The new password reset flow: * User requests a password reset. * Danbooru emails user a password reset link. * User follows link to password edit page. * The link contains a signed_user_id param authenticating the user. * User changes their own password.
This commit is contained in:
@@ -8,12 +8,12 @@ module Danbooru
|
||||
@verifier = ActiveSupport::MessageVerifier.new(secret, serializer: JSON, digest: "SHA256")
|
||||
end
|
||||
|
||||
def generate(*options)
|
||||
verifier.generate(*options, purpose: purpose)
|
||||
def generate(*args, **options)
|
||||
verifier.generate(*args, purpose: purpose, **options)
|
||||
end
|
||||
|
||||
def verified(*options)
|
||||
verifier.verified(*options, purpose: purpose)
|
||||
def verify(*args, **options)
|
||||
verifier.verify(*args, purpose: purpose, **options)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user