43 lines
1.8 KiB
Ruby
43 lines
1.8 KiB
Ruby
class EmailConfirmationsController < ApplicationController
|
|
# Resend form - for whoever's original confirmation link expired out of
|
|
# their inbox, landed in spam, or was simply never sent because a typo in
|
|
# the signup form pointed User#generates_token_for at an address they
|
|
# don't control.
|
|
def new
|
|
render(:new)
|
|
end
|
|
|
|
# Same enumeration-safe shape as PasswordResetsController#create: the
|
|
# response never reveals whether the address has an account here, or
|
|
# whether it is already confirmed - branching on either would turn this
|
|
# form into a one-guess-at-a-time oracle for both facts.
|
|
def create
|
|
email = params.require('email_confirmation').permit(:email).to_h['email']
|
|
user = User.find_by(email: email)
|
|
if user && !user.confirmed?
|
|
NotificationMailer.confirmation_instructions(user.id, user.generate_token_for(:email_confirmation)).deliver_later
|
|
end
|
|
flash[:notice] = t('email_confirmations.instructions_sent_notice')
|
|
redirect url_for(:new_session)
|
|
end
|
|
|
|
# Reached via a plain GET from the link in the confirmation email, like
|
|
# PasswordResetsController#edit - safe to expose over GET (and to visit
|
|
# more than once) because, unlike a password reset, confirming does not
|
|
# hand the visitor anything sensitive and does not itself change the
|
|
# fingerprint (email) the token was minted under, so a bookmarked or
|
|
# double-clicked link keeps working instead of dying after first use.
|
|
def show
|
|
user = User.find_by_token_for(:email_confirmation, params['token'])
|
|
unless user
|
|
flash[:notice] = t('email_confirmations.invalid_token_notice')
|
|
redirect url_for(:new_email_confirmation)
|
|
return
|
|
end
|
|
|
|
user.update!(confirmed_at: Time.now.utc) unless user.confirmed?
|
|
flash[:notice] = t('email_confirmations.confirmed_notice')
|
|
redirect url_for(:root)
|
|
end
|
|
end
|