5625458f69
The old password reset flow: * User requests a password reset. * Danbooru generates a password reset nonce. * Danbooru emails user a password reset confirmation link. * User follows link to password reset confirmation page. * The link contains a nonce authenticating the user. * User confirms password reset. * Danbooru resets user's password to a random string. * Danbooru emails user their new password in plaintext. The new password reset flow: * User requests a password reset. * Danbooru emails user a password reset link. * User follows link to password edit page. * The link contains a signed_user_id param authenticating the user. * User changes their own password.
15 lines
356 B
Ruby
15 lines
356 B
Ruby
class PasswordResetsController < ApplicationController
|
|
respond_to :html, :xml, :json
|
|
|
|
def create
|
|
@user = User.find_by_name(params.dig(:user, :name))
|
|
UserMailer.password_reset(@user).deliver_later
|
|
|
|
flash[:notice] = "Password reset email sent. Check your email"
|
|
respond_with(@user, location: new_session_path)
|
|
end
|
|
|
|
def show
|
|
end
|
|
end
|