Verify the user is confirmed before returning a reset password token

Co-authored-by: Maikel <maikel@email.org.au>
This commit is contained in:
Luis Ramos
2020-07-31 09:08:48 +01:00
parent 7c498a573c
commit d052a7b796

View File

@@ -44,7 +44,7 @@ class UserConfirmationsController < DeviseController
'not_confirmed'
end
if resource.reset_password_token.present?
if result == 'confirmed' && resource.reset_password_token.present?
raw_reset_password_token = resource.regenerate_reset_password_token
return spree.edit_spree_user_password_path(
reset_password_token: raw_reset_password_token